[RESTRICT AUTOMERGE] Restrict app transition maximum duration
As WindowState#startAnimation for restricting window animation duration
(currently is 10 secs),
For security reason, we also need to restrict app transition animation
duration as 3 secs to prevent malicious app may set a long duration or
infinity repeat counts through ActivityOption#makeCustomAnimation or
Activity#overridePendingTransition with custom animation set.
Bug: 145728687
Test: manual as issue provided test app
Change-Id: I39051d6e4d2b681ce2becbafe14aab3f3d8ebf6b
diff --git a/services/core/java/com/android/server/wm/AppTransition.java b/services/core/java/com/android/server/wm/AppTransition.java
index e6a83de..6aed41a 100644
--- a/services/core/java/com/android/server/wm/AppTransition.java
+++ b/services/core/java/com/android/server/wm/AppTransition.java
@@ -168,6 +168,7 @@
private static final int MAX_CLIP_REVEAL_TRANSITION_DURATION = 420;
private static final int THUMBNAIL_APP_TRANSITION_DURATION = 336;
private static final long APP_TRANSITION_TIMEOUT_MS = 5000;
+ static final int MAX_APP_TRANSITION_DURATION = 3 * 1000; // 3 secs.
private final Context mContext;
private final WindowManagerService mService;
diff --git a/services/core/java/com/android/server/wm/AppWindowToken.java b/services/core/java/com/android/server/wm/AppWindowToken.java
index eab5e0d..ebb8a9f 100644
--- a/services/core/java/com/android/server/wm/AppWindowToken.java
+++ b/services/core/java/com/android/server/wm/AppWindowToken.java
@@ -38,6 +38,7 @@
import static com.android.server.policy.WindowManagerPolicy.FINISH_LAYOUT_REDO_ANIM;
import static com.android.server.policy.WindowManagerPolicy.FINISH_LAYOUT_REDO_WALLPAPER;
+import static com.android.server.wm.AppTransition.MAX_APP_TRANSITION_DURATION;
import static com.android.server.wm.AppWindowTokenProto.ALL_DRAWN;
import static com.android.server.wm.AppWindowTokenProto.APP_STOPPED;
import static com.android.server.wm.AppWindowTokenProto.CLIENT_HIDDEN;
@@ -2679,7 +2680,16 @@
displayConfig.uiMode, displayConfig.orientation, frame, displayFrame, insets,
surfaceInsets, stableInsets, isVoiceInteraction, freeform, getTask().mTaskId);
if (a != null) {
- if (DEBUG_ANIM) logWithStack(TAG, "Loaded animation " + a + " for " + this);
+ if (a != null) {
+ // Setup the maximum app transition duration to prevent malicious app may set a long
+ // animation duration or infinite repeat counts for the app transition through
+ // ActivityOption#makeCustomAnimation or WindowManager#overridePendingTransition.
+ a.restrictDuration(MAX_APP_TRANSITION_DURATION);
+ }
+ if (DEBUG_ANIM) {
+ logWithStack(TAG, "Loaded animation " + a + " for " + this
+ + ", duration: " + ((a != null) ? a.getDuration() : 0));
+ }
final int containingWidth = frame.width();
final int containingHeight = frame.height();
a.initialize(containingWidth, containingHeight, width, height);