commit 54e57bbbd679cd7dd25c394d98ae399c8312a867
author Louis Chang <louischang@google.com> Tue Aug 02 03:33:39 2022 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Wed Sep 14 17:52:23 2022 +0000
tree f945e64f7a95eab5334af085d331f2e2e047b0b8
parent 76769dc120ba5a0fc9cfeeba16cd712b6ac25dfb

Do not send new Intent to non-exported activity when navigateUpTo

The new Intent was delivered to a non-exported activity while
#navigateUpTo was called from an Activity of a different uid.

Bug: 238605611
Test: atest StartActivityTests
Change-Id: I854dd825bfd9a2c08851980d480d1f3a177af6cf
Merged-In: I854dd825bfd9a2c08851980d480d1f3a177af6cf
(cherry picked from commit 4c355690494f17c8ebdecbc8b1a1eaef21ffc0f3)
Merged-In: I854dd825bfd9a2c08851980d480d1f3a177af6cf

services/core/java/com/android/server/wm/Task.java

diff --git a/services/core/java/com/android/server/wm/Task.java b/services/core/java/com/android/server/wm/Task.java
index bf5246f..888dc3a 100644
--- a/services/core/java/com/android/server/wm/Task.java
+++ b/services/core/java/com/android/server/wm/Task.java
@@ -5457,7 +5457,23 @@
                     parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TASK ||
                     parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TOP ||
                     (destIntentFlags & Intent.FLAG_ACTIVITY_CLEAR_TOP) != 0) {
-                parent.deliverNewIntentLocked(callingUid, destIntent, destGrants, srec.packageName);
+                boolean abort;
+                try {
+                    abort = !mTaskSupervisor.checkStartAnyActivityPermission(destIntent,
+                            parent.info, null /* resultWho */, -1 /* requestCode */, srec.getPid(),
+                            callingUid, srec.info.packageName, null /* callingFeatureId */,
+                            false /* ignoreTargetSecurity */, false /* launchingInTask */, srec.app,
+                            null /* resultRecord */, null /* resultRootTask */);
+                } catch (SecurityException e) {
+                    abort = true;
+                }
+                if (abort) {
+                    android.util.EventLog.writeEvent(0x534e4554, "238605611", callingUid, "");
+                    foundParentInTask = false;
+                } else {
+                    parent.deliverNewIntentLocked(callingUid, destIntent, destGrants,
+                            srec.packageName);
+                }
             } else {
                 try {
                     ActivityInfo aInfo = AppGlobals.getPackageManager().getActivityInfo(