)]}'
{
  "commit": "e169526f58a1a68d45d1c50d1fad8fe72dfe0da4",
  "tree": "234794421af1eb03dd9457058394023e85114c7a",
  "parents": [
    "b57d1409c52478d37f006145949be8b4591b9898"
  ],
  "author": {
    "name": "Curtis Belmonte",
    "email": "curtislb@google.com",
    "time": "Thu Oct 01 17:57:27 2020 -0700"
  },
  "committer": {
    "name": "android-build-team Robot",
    "email": "android-build-team-robot@google.com",
    "time": "Wed Nov 18 22:50:54 2020 +0000"
  },
  "message": "DO NOT MERGE Check fingerprint client against top activity in auth callback\n\nDue to a race condition with activity task stack broadcasts, it\u0027s\ncurrently possible for fingerprint authentication to succeed for a\nnon-top activity. This means, for example, that a malicious overlay\ncould be drawn in order to mislead the user about what they are\nauthenticating for.\n\nThis commit addresses the issue by adding a check to the biometric\nauthentication client interface that ensures the authenticating\nactivity is on top at the time of authentication. Otherwise, the\npending authentication will fail, as if an incorrect biometric had\nbeen presented.\n\nTest: Follow steps from b/159249069:\n1. Install com.pro100svitlo.fingerprintauthdemo from the Play store.\n2. Install the PoC attack app from b/159249069.\n3. Start the PoC attack app and press the \"Launch PoC attack\" button.\n4. Use fingerprint to authenticate while the overlay is showing.\n\nBefore: Authentication succeeds, and a new activity is launched.\nAfter: Authentication fails, and no new activity is launched.\n\nBug: 159249069\nChange-Id: Ie5a0f8c3e9b92d348a78678a6ed192d440c45ffc\nMerged-In: I289d67e5c7055ed60f7a96725c523d07cd047b23\nMerged-In: I3a810cd7e6b97333f648c978e44242662342ec57\n(cherry picked from commit 09c1b8ebf9e58cd402ec6a7ae9b1948cf83982d1)\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "edc8f15a9a03cea489e04dba767bf10fa8758bd2",
      "old_mode": 33188,
      "old_path": "services/core/java/com/android/server/biometrics/AuthenticationClient.java",
      "new_id": "8ca37b813b63acd37ab4d43dd2c821999d198d10",
      "new_mode": 33188,
      "new_path": "services/core/java/com/android/server/biometrics/AuthenticationClient.java"
    }
  ]
}