commit e17b1e1282c80473a28b506d56d5c9b313caaa2c
author Hani Kazmi <hanikazmi@google.com> Fri Oct 21 15:16:52 2022 +0000
committer Achim Thesmann <achim@google.com> Wed Aug 06 00:43:37 2025 +0000
tree 696e978621f11bebb51632df0f97df2cd1c4fc19
parent 4bbab50b03ca0b80de0b67519996d12f3b5be5bf

Convert bundle defuse logs to wtf

After recent work on making bundles lazy, deserialization errors due to
missing classes should be approaching zero. This change converts defuse
logs to errors on debug builds to find other error causes in system
server. Depending on findings, defuse may be deprecated.

Bug: 254848919
Test: m and manually tested
Flag: android.security.deprecate_bundle_defuse
Change-Id: Iece0d4108e3389e0d61c3c0b47be82982fa27af1

core/java/android/os/BaseBundle.java

diff --git a/core/java/android/os/BaseBundle.java b/core/java/android/os/BaseBundle.java
index dd9e569..c605744 100644
--- a/core/java/android/os/BaseBundle.java
+++ b/core/java/android/os/BaseBundle.java
@@ -22,6 +22,7 @@
 import android.annotation.Nullable;
 import android.compat.annotation.UnsupportedAppUsage;
 import android.content.Intent;
+import android.security.Flags;
 import android.util.ArrayMap;
 import android.util.Log;
 import android.util.MathUtils;
@@ -446,7 +447,16 @@
                 object = ((BiFunction<Class<?>, Class<?>[], ?>) object).apply(clazz, itemTypes);
             } catch (BadParcelableException e) {
                 if (sShouldDefuse) {
-                    Log.w(TAG, "Failed to parse item " + mMap.keyAt(i) + ", returning null.", e);
+                    if (Flags.wtfBundleDefuse()) {
+                        Slog.wtf(TAG, "Failed to parse item " + mMap.keyAt(i) + ", returning null.",
+                                e);
+                    } else {
+                        Log.w(TAG, "Failed to parse item " + mMap.keyAt(i) + ", returning null.",
+                                e);
+                    }
+                    if (Flags.deprecateBundleDefuse()) {
+                        throw e;
+                    }
                     return null;
                 } else {
                     throw e;
@@ -507,7 +517,14 @@
                     /* lazy */ ownsParcel, this, numLazyValues);
         } catch (BadParcelableException e) {
             if (sShouldDefuse) {
-                Log.w(TAG, "Failed to parse Bundle, but defusing quietly", e);
+                if (Flags.wtfBundleDefuse()) {
+                    Slog.wtf(TAG, "Failed to parse Bundle, but defusing quietly", e);
+                } else {
+                    Log.w(TAG, "Failed to parse Bundle, but defusing quietly", e);
+                }
+                if (Flags.deprecateBundleDefuse()) {
+                    throw e;
+                }
                 map.erase();
             } else {
                 throw e;

core/java/android/security/responsible_apis_flags.aconfig

diff --git a/core/java/android/security/responsible_apis_flags.aconfig b/core/java/android/security/responsible_apis_flags.aconfig
index 6f24f55..bedd3a5 100644
--- a/core/java/android/security/responsible_apis_flags.aconfig
+++ b/core/java/android/security/responsible_apis_flags.aconfig
@@ -179,3 +179,23 @@
     description: "Flag for failing instead of logging in case of parcel size mismatches"
     bug: "416031865"
 }
+
+flag {
+    name: "wtf_bundle_defuse"
+    namespace: "responsible_apis"
+    description: "Flag for wtf logging when defuse is enabled."
+    bug: "254848919"
+    metadata {
+        purpose: PURPOSE_BUGFIX
+    }
+}
+
+flag {
+    name: "deprecate_bundle_defuse"
+    namespace: "responsible_apis"
+    description: "Flag for failing instead of logging when defuse is enabled."
+    bug: "254848919"
+    metadata {
+        purpose: PURPOSE_BUGFIX
+    }
+}