hostsidetests/securitybulletin/test-apps/CVE-2021-39626/src/android/security/cts/CVE_2021_39626/DeviceTest.java

/*
 * Copyright (C) 2022 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package android.security.cts.CVE_2021_39626;

import static org.junit.Assert.assertFalse;
import static org.junit.Assume.assumeNoException;
import static org.junit.Assume.assumeNotNull;
import static org.junit.Assume.assumeTrue;

import android.bluetooth.BluetoothAdapter;
import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.content.pm.PackageManager;
import android.provider.Settings;

import androidx.test.InstrumentationRegistry;
import androidx.test.runner.AndroidJUnit4;
import androidx.test.uiautomator.By;
import androidx.test.uiautomator.UiDevice;
import androidx.test.uiautomator.Until;

import org.junit.Test;
import org.junit.runner.RunWith;

@RunWith(AndroidJUnit4.class)
public class DeviceTest {
    private static final int TIMEOUT = 5000;
    private static Context context;

    private static String getSettingsPkgName() {
        Intent settingsIntent = new Intent(Settings.ACTION_SETTINGS);
        ComponentName settingsComponent =
                settingsIntent.resolveActivity(context.getPackageManager());
        String pkgName = settingsComponent != null ? settingsComponent.getPackageName()
                : "com.android.settings";
        assumeNotNull(pkgName);
        return pkgName;
    }

    private void openApplication(String applicationName) {
        Intent intent = context.getPackageManager().getLaunchIntentForPackage(applicationName);
        assumeNotNull(intent);
        intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK);
        try {
            context.startActivity(intent);
        } catch (Exception e) {
            assumeNoException(e);
        }
    }

    @Test
    public void testBtDiscoverable() {
        // Initialize UiDevice instance
        UiDevice device = UiDevice.getInstance(InstrumentationRegistry.getInstrumentation());
        context = InstrumentationRegistry.getInstrumentation().getContext();
        BluetoothAdapter btAdapter = BluetoothAdapter.getDefaultAdapter();
        assumeNotNull(btAdapter);

        // Save the state of bluetooth adapter to reset after the test
        boolean btState = btAdapter.isEnabled();
        if (!btState) {
            // If bluetooth is disabled, enable it and wait for adapter startup to complete
            assumeTrue(btAdapter.enable());
            try {
                Thread.sleep(TIMEOUT);
            } catch (Exception e) {
                assumeNoException(e);
            }
        }
        assumeTrue(btAdapter.isEnabled());

        // Launch the PoC application and ensure that it launches bluetooth settings
        openApplication(context.getPackageName());
        assumeTrue(device.wait(Until.hasObject(By.pkg(getSettingsPkgName())), TIMEOUT));

        boolean isBtDiscoverable =
                (btAdapter.getScanMode() == btAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE);

        // Disable bluetooth if it was OFF before the test
        if (!btState) {
            btAdapter.disable();
        }

        // The test fails if bluetooth is made discoverable through PoC
        assertFalse("Vulnerable to b/194695497 !!", isBtDiscoverable);
    }
}