commit 6ffe14035cf14e5d1a5f78e62f5e70ed2bb996e3
author Adam Powell <adamp@google.com> Thu Apr 28 16:32:18 2016 -0700
committer The Android Automerger <android-build@google.com> Wed Jun 01 16:10:13 2016 -0700
tree c513c79b2a7dedfd4b3e3af9da64796e4fd363d1
parent dae4f0048cdb127ea32cf6252d3bae573f99550f

Backport ChooserTarget package source check from N

Fix a bug where a ChooserTargetService could supply a ChooserTarget
pointing at a non-exported activity outside of its own package and
have it launch.

Bug 28384423

Change-Id: I3f5854f91c5695ad9253d71055ef58224df47008
(cherry picked from commit 82b9565bd13e2c5dac20b3221b7be28c5afe57ea)

core/java/com/android/internal/app/ChooserActivity.java

diff --git a/core/java/com/android/internal/app/ChooserActivity.java b/core/java/com/android/internal/app/ChooserActivity.java
index 7699673..e137f94 100644
--- a/core/java/com/android/internal/app/ChooserActivity.java
+++ b/core/java/com/android/internal/app/ChooserActivity.java
@@ -656,7 +656,19 @@
             }
             intent.setComponent(mChooserTarget.getComponentName());
             intent.putExtras(mChooserTarget.getIntentExtras());
-            activity.startActivityAsCaller(intent, options, true, userId);
+
+            // Important: we will ignore the target security checks in ActivityManager
+            // if and only if the ChooserTarget's target package is the same package
+            // where we got the ChooserTargetService that provided it. This lets a
+            // ChooserTargetService provide a non-exported or permission-guarded target
+            // to the chooser for the user to pick.
+            //
+            // If mSourceInfo is null, we got this ChooserTarget from the caller or elsewhere
+            // so we'll obey the caller's normal security checks.
+            final boolean ignoreTargetSecurity = mSourceInfo != null
+                    && mSourceInfo.getResolvedComponentName().getPackageName()
+                    .equals(mChooserTarget.getComponentName().getPackageName());
+            activity.startActivityAsCaller(intent, options, ignoreTargetSecurity, userId);
             return true;
         }