Use loadSafeLabel to prevent UI spoofing in CertInstaller
Change appInfo.loadLabel(pm) to appInfo.loadSafeLabel(pm) in
getCallingAppLabel(). This ensures that the application label is
properly sanitized by the system, stripping potentially harmful
characters like newlines.
This addresses a vulnerability where a malicious application could use a
crafted label to push the CA certificate installation warning
off-screen, potentially tricking users into installing untrusted CA
certificates. Using loadSafeLabel is a more direct fix within the
existing method.
This change corrects an erroneous behavior and is considered a low-risk
bug fix.
Bug: 471127462
Test: Manually tested by installing the PoC app from the bug report. Verified that the dialog now displays the calling app name correctly without pushing down the warning message.
Flag: EXEMPT BUGFIX
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:0034ca47f9c3552e0f2d5e361f210eb92e6db805
Use loadSafeLabel to prevent UI spoofing in CertInstaller
Change appInfo.loadLabel(pm) to appInfo.loadSafeLabel(pm) in
getCallingAppLabel(). This ensures that the application label is
properly sanitized by the system, stripping potentially harmful
characters like newlines.
This addresses a vulnerability where a malicious application could use a
crafted label to push the CA certificate installation warning
off-screen, potentially tricking users into installing untrusted CA
certificates. Using loadSafeLabel is a more direct fix within the
existing method.
This change corrects an erroneous behavior and is considered a low-risk
bug fix.
Bug: 471127462
Test: Manually tested by installing the PoC app from the bug report. Verified that the dialog now displays the calling app name correctly without pushing down the warning message.
Flag: EXEMPT BUGFIX
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:41228b5ffcfc45257a37fe818aa54ae8c5004b3b
Merged-In: I2c897b106318f001cc3d5c92fe12e9dbf9d90c95
Change-Id: I2c897b106318f001cc3d5c92fe12e9dbf9d90c95
1 file changed