| commit | 042b52a8551fa84a0e17e9ad8db2fcf30002569a | [log] [tgz] |
|---|---|---|
| author | oli <olit@google.com> | Wed May 21 14:38:32 2025 +0000 |
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | Fri Oct 10 13:59:41 2025 -0700 |
| tree | c249114f41f609c710abc298e3ae63d055eb6cd6 | |
| parent | f08b9104a6e9609ad30205d00ff8c88b45c9e87a [diff] |
Add resolveActivityAsUserForExplicitType api to pm allow checking for resolved activity for an intent with a specific type allowing the intent to declare its own type can lead to a security vulnerability if the intent changes its type after the IntentForwarder#canForward check. Use the new API in IntentForwarderActivity to prevent checking the intent's type twice. Update other call sites of IntentForwarder#canForward to extract the resolved type from the intent and pass in to to the method call Check the launch package rather than calling package sanitize intent selector as well as received intent Bug: 403565650 407763772 397216638 Flag: EXEMPT bugfix Test: manually tested (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:57233409d9bb5aef50373760a9b6551aa618c808) Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:4f0b02dea6c4f508c9b3aef8fff9910e80041d30 Merged-In: I8453f25ed5ddd938718f4d2be4983c881778f281 Change-Id: I8453f25ed5ddd938718f4d2be4983c881778f281