[RESTRICT AUTOMERGE] Ignore small source rect hint
Which may be abused by malicious app to create a non-visible PiP
window that bypasses the background restriction.
Bug: 270368476
Test: Manually, using the POC app
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:59ef2c19e559bfc3f29974d63735758185975074)
Merged-In: I3531a64fc67a1b6c43997ee33b7a7d4ab4e2d985
Change-Id: I3531a64fc67a1b6c43997ee33b7a7d4ab4e2d985
diff --git a/libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipBoundsAlgorithm.java b/libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipBoundsAlgorithm.java
index a4b866aa..b23b431 100644
--- a/libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipBoundsAlgorithm.java
+++ b/libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipBoundsAlgorithm.java
@@ -182,6 +182,21 @@
return null;
}
+ /**
+ * Returns the source hint rect if it is valid (if provided and is contained by the current
+ * task bounds and not too small).
+ */
+ public static Rect getValidSourceHintRect(PictureInPictureParams params, Rect sourceBounds,
+ @NonNull Rect destinationBounds) {
+ final Rect sourceHintRect = getValidSourceHintRect(params, sourceBounds);
+ if (sourceHintRect != null
+ && sourceHintRect.width() > destinationBounds.width()
+ && sourceHintRect.height() > destinationBounds.height()) {
+ return sourceHintRect;
+ }
+ return null;
+ }
+
public float getDefaultAspectRatio() {
return mDefaultAspectRatio;
}
diff --git a/libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java b/libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java
index f0b2716..c80f394 100644
--- a/libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java
+++ b/libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTaskOrganizer.java
@@ -553,7 +553,7 @@
if (mOneShotAnimationType == ANIM_TYPE_BOUNDS) {
mPipMenuController.attach(mLeash);
final Rect sourceHintRect = PipBoundsAlgorithm.getValidSourceHintRect(
- info.pictureInPictureParams, currentBounds);
+ info.pictureInPictureParams, currentBounds, destinationBounds);
scheduleAnimateResizePip(currentBounds, destinationBounds, 0 /* startingAngle */,
sourceHintRect, TRANSITION_DIRECTION_TO_PIP, mEnterAnimationDuration,
null /* updateBoundsCallback */);
@@ -579,9 +579,9 @@
return;
}
final Rect currentBounds = mTaskInfo.configuration.windowConfiguration.getBounds();
- final Rect sourceHintRect = PipBoundsAlgorithm.getValidSourceHintRect(
- mPictureInPictureParams, currentBounds);
final Rect destinationBounds = mPipBoundsAlgorithm.getEntryDestinationBounds();
+ final Rect sourceHintRect = PipBoundsAlgorithm.getValidSourceHintRect(
+ mPictureInPictureParams, currentBounds, destinationBounds);
animateResizePip(currentBounds, destinationBounds, sourceHintRect,
TRANSITION_DIRECTION_TO_PIP, mEnterAnimationDuration, 0 /* startingAngle */);
mPipTransitionState.setTransitionState(PipTransitionState.ENTERING_PIP);
diff --git a/libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTransition.java b/libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTransition.java
index b31e6e0..94eaedf 100644
--- a/libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTransition.java
+++ b/libs/WindowManager/Shell/src/com/android/wm/shell/pip/PipTransition.java
@@ -318,7 +318,7 @@
if (mOneShotAnimationType == ANIM_TYPE_BOUNDS) {
final Rect sourceHintRect =
PipBoundsAlgorithm.getValidSourceHintRect(
- taskInfo.pictureInPictureParams, currentBounds);
+ taskInfo.pictureInPictureParams, currentBounds, destinationBounds);
animator = mPipAnimationController.getAnimator(taskInfo, leash, currentBounds,
currentBounds, destinationBounds, sourceHintRect, TRANSITION_DIRECTION_TO_PIP,
0 /* startingAngle */, rotationDelta);