Fix the issue provider can be wrong when requesting slice permission
SlicePermissionActivity reads provider_pkg from intent, which can be
modified at will. As a result user might see incorrect package name in
the dialog granting slice permission.
Bug: 159145361
Test: manual
Merged-In: I8b66c02786df4096dad74b7e76255d5ddd1d609d
Change-Id: I8b66c02786df4096dad74b7e76255d5ddd1d609d
(cherry picked from commit 4344e632953b103910b48d43f4eb226b38ed5048)
diff --git a/core/java/android/app/slice/SliceProvider.java b/core/java/android/app/slice/SliceProvider.java
index bd1eea5..46be548 100644
--- a/core/java/android/app/slice/SliceProvider.java
+++ b/core/java/android/app/slice/SliceProvider.java
@@ -153,6 +153,7 @@
*/
public static final String EXTRA_PKG = "pkg";
/**
+ * @Deprecated provider pkg is now being extracted in SlicePermissionActivity
* @hide
*/
public static final String EXTRA_PROVIDER_PKG = "provider_pkg";
diff --git a/packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java b/packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java
index 449ed8c..1b241b7 100644
--- a/packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java
+++ b/packages/SystemUI/src/com/android/systemui/SlicePermissionActivity.java
@@ -16,6 +16,7 @@
import static android.view.WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS;
+import android.annotation.Nullable;
import android.app.Activity;
import android.app.AlertDialog;
import android.app.slice.SliceManager;
@@ -29,6 +30,7 @@
import android.net.Uri;
import android.os.Bundle;
import android.text.BidiFormatter;
+import android.util.EventLog;
import android.util.Log;
import android.widget.CheckBox;
import android.widget.TextView;
@@ -50,10 +52,12 @@
mUri = getIntent().getParcelableExtra(SliceProvider.EXTRA_BIND_URI);
mCallingPkg = getIntent().getStringExtra(SliceProvider.EXTRA_PKG);
- mProviderPkg = getIntent().getStringExtra(SliceProvider.EXTRA_PROVIDER_PKG);
try {
PackageManager pm = getPackageManager();
+ mProviderPkg = pm.resolveContentProvider(mUri.getAuthority(),
+ PackageManager.GET_META_DATA).applicationInfo.packageName;
+ verifyCallingPkg();
CharSequence app1 = BidiFormatter.getInstance().unicodeWrap(pm.getApplicationInfo(
mCallingPkg, 0).loadSafeLabel(pm, PackageItemInfo.DEFAULT_MAX_LABEL_SIZE_PX,
PackageItemInfo.SAFE_LABEL_FLAG_TRIM
@@ -97,4 +101,29 @@
public void onDismiss(DialogInterface dialog) {
finish();
}
+
+ private void verifyCallingPkg() {
+ final String providerPkg = getIntent().getStringExtra(SliceProvider.EXTRA_PROVIDER_PKG);
+ if (providerPkg == null || mProviderPkg.equals(providerPkg)) return;
+ final String callingPkg = getCallingPkg();
+ EventLog.writeEvent(0x534e4554, "159145361", getUid(callingPkg), String.format(
+ "pkg %s (disguised as %s) attempted to request permission to show %s slices in %s",
+ callingPkg, providerPkg, mProviderPkg, mCallingPkg));
+ }
+
+ @Nullable
+ private String getCallingPkg() {
+ final Uri referrer = getReferrer();
+ if (referrer == null) return null;
+ return referrer.getHost();
+ }
+
+ private int getUid(@Nullable final String pkg) {
+ if (pkg == null) return -1;
+ try {
+ return getPackageManager().getApplicationInfo(pkg, 0).uid;
+ } catch (NameNotFoundException e) {
+ }
+ return -1;
+ }
}
