hostsidetests/securitybulletin/test-apps/CVE-2021-39626/src/android/security/cts/CVE_2021_39626/DeviceTest.java

/*
 * Copyright (C) 2022 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package android.security.cts.CVE_2021_39626;

import static org.junit.Assert.assertFalse;
import static org.junit.Assume.assumeNoException;
import static org.junit.Assume.assumeTrue;

import android.bluetooth.BluetoothAdapter;
import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.content.SharedPreferences;
import android.content.SharedPreferences.OnSharedPreferenceChangeListener;
import android.content.res.Resources;
import android.provider.Settings;

import androidx.test.InstrumentationRegistry;
import androidx.test.runner.AndroidJUnit4;
import androidx.test.uiautomator.By;
import androidx.test.uiautomator.UiDevice;
import androidx.test.uiautomator.Until;

import org.junit.After;
import org.junit.Test;
import org.junit.runner.RunWith;

import java.util.concurrent.Semaphore;
import java.util.concurrent.TimeUnit;

@RunWith(AndroidJUnit4.class)
public class DeviceTest {
    static final int TIMEOUT = 10000;
    boolean mBtState = false;
    BluetoothAdapter mBtAdapter;
    Context mContext;
    OnSharedPreferenceChangeListener mListener;
    Resources mResources;
    SharedPreferences mSharedPrefs;
    Semaphore mPreferenceChanged;
    UiDevice mDevice;

    private String getSettingsPkgName() {
        Intent settingsIntent = new Intent(Settings.ACTION_SETTINGS);
        ComponentName settingsComponent =
                settingsIntent.resolveActivity(mContext.getPackageManager());
        String pkgName = settingsComponent != null ? settingsComponent.getPackageName()
                : mContext.getString(R.string.defaultSettingsPkg);
        return pkgName;
    }

    @After
    public void tearDown() {
        try {
            // Disable bluetooth if it was OFF before the test
            if (!mBtState) {
                Intent intent = new Intent(mContext, PocActivity.class);
                intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
                intent.putExtra(mContext.getString(R.string.btAction),
                        BluetoothAdapter.ACTION_REQUEST_DISABLE);
                mContext.startActivity(intent);
            }
            mPreferenceChanged = new Semaphore(0);
            mPreferenceChanged.tryAcquire(TIMEOUT, TimeUnit.MILLISECONDS);
            int result = mSharedPrefs.getInt(mResources.getString(R.string.resultKey),
                    mResources.getInteger(R.integer.assumptionFailure));
            String message = mSharedPrefs.getString(mResources.getString(R.string.messageKey),
                    mResources.getString(R.string.defaultSemaphoreMsg));

            // Go to home screen
            mDevice.pressHome();
        } catch (Exception e) {
            // ignore the exception
        }
    }

    @Test
    public void testBtDiscoverable() {
        try {
            // Initialize UiDevice instance
            mDevice = UiDevice.getInstance(InstrumentationRegistry.getInstrumentation());
            mContext = InstrumentationRegistry.getInstrumentation().getContext();
            mBtAdapter = BluetoothAdapter.getDefaultAdapter();

            // Save the state of bluetooth adapter to reset after the test
            mBtState = mBtAdapter.isEnabled();

            // If bluetooth is disabled, enable it and wait for start activity to complete
            Intent intent = new Intent(mContext, PocActivity.class);
            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
            intent.putExtra(mContext.getString(R.string.btAction),
                    BluetoothAdapter.ACTION_REQUEST_ENABLE);
            mContext.startActivity(intent);
            mResources = mContext.getResources();

            mSharedPrefs = mContext.getSharedPreferences(
                    mResources.getString(R.string.sharedPreferences), Context.MODE_APPEND);
            mPreferenceChanged = new Semaphore(0);
            mListener = new OnSharedPreferenceChangeListener() {
                @Override
                public void onSharedPreferenceChanged(SharedPreferences sharedPreferences,
                        String key) {
                    if (key.equals(mResources.getString(R.string.resultKey))) {
                        mPreferenceChanged.release();
                    }
                }
            };
            mSharedPrefs.registerOnSharedPreferenceChangeListener(mListener);
            mPreferenceChanged.tryAcquire(TIMEOUT, TimeUnit.MILLISECONDS);

            int result = mSharedPrefs.getInt(mResources.getString(R.string.resultKey),
                    mResources.getInteger(R.integer.assumptionFailure));
            String message = mSharedPrefs.getString(mResources.getString(R.string.messageKey),
                    mResources.getString(R.string.defaultSemaphoreMsg));
            assumeTrue(message, result != mResources.getInteger(R.integer.assumptionFailure));

            // Checking if bluetooth is enabled. The test requires bluetooth to be enabled,
            // assumption failing the test if it's not enabled
            assumeTrue(mBtAdapter.isEnabled());

            // Launch bluetooth settings which is supposed to set scan mode to
            // SCAN_MODE_CONNECTABLE_DISCOVERABLE if vulnerability is active
            intent = new Intent();
            intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
            String settingsPkg = getSettingsPkgName();
            intent.setClassName(settingsPkg, settingsPkg + mContext.getString(R.string.className));
            mContext.startActivity(intent);

            assumeTrue(mDevice.wait(Until.hasObject(By.pkg(settingsPkg)), TIMEOUT));

            boolean isBtDiscoverable = false;
            isBtDiscoverable =
                    (mBtAdapter.getScanMode() == mBtAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE);

            // The test fails if bluetooth is made discoverable through PoC
            assertFalse(mContext.getString(R.string.failMessage), isBtDiscoverable);
        } catch (Exception e) {
            assumeNoException(e);
        }
    }
}