commit 6a1dd25117d5406d3befe404335202623778736a
author Aditya Singh <adityasngh@google.com> Mon Sep 09 15:40:13 2024 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Wed Oct 09 22:52:34 2024 +0000
tree 4db2bfe00dd54a300f0993640b188fad10a4ec84
parent 69ca3141a9c30fde9dc6a862756dc8380f60427c

Prevent clickjacking attack in DocsUi.

* Added permission `HIDE_OVERLAY_WINDOWS` in the Manifest.
* Set the flag to hide overlay windows to true in BaseActivity and
  ConfirmFragment.

Bug: 233605527
Test: Manually, see http://b/233605527#comment4
Flag: EXEMPT bugfix
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:4f610dc4830093b42934090fcf5bc129b639c693)
Merged-In: I511730856be58cad3e13fa50bfac1e1ee2f5fee0
Change-Id: I511730856be58cad3e13fa50bfac1e1ee2f5fee0

AndroidManifest.xml

diff --git a/AndroidManifest.xml b/AndroidManifest.xml
index ef86ab7..f536d81 100644
--- a/AndroidManifest.xml
+++ b/AndroidManifest.xml
@@ -33,6 +33,7 @@
     <uses-permission android:name="android.permission.MODIFY_QUIET_MODE" />
     <uses-permission android:name="android.permission.QUERY_ALL_PACKAGES" />
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission android:name="android.permission.HIDE_OVERLAY_WINDOWS"/>
 
     <!-- Permissions required for reading and logging compat changes -->
     <uses-permission android:name="android.permission.LOG_COMPAT_CHANGE"/>

src/com/android/documentsui/BaseActivity.java

diff --git a/src/com/android/documentsui/BaseActivity.java b/src/com/android/documentsui/BaseActivity.java
index c6cbc19..5af3314 100644
--- a/src/com/android/documentsui/BaseActivity.java
+++ b/src/com/android/documentsui/BaseActivity.java
@@ -74,6 +74,7 @@
 import com.android.documentsui.sidebar.RootsFragment;
 import com.android.documentsui.sorting.SortController;
 import com.android.documentsui.sorting.SortModel;
+import com.android.modules.utils.build.SdkLevel;
 
 import com.android.documentsui.util.VersionUtils;
 import com.google.android.material.appbar.AppBarLayout;
@@ -135,6 +136,10 @@
         // Record the time when onCreate is invoked for metric.
         mStartTime = new Date().getTime();
 
+        if (SdkLevel.isAtLeastS()) {
+            getWindow().setHideOverlayWindows(true);
+        }
+
         // ToDo Create tool to check resource version before applyStyle for the theme
         // If version code is not match, we should reset overlay package to default,
         // in case Activity continueusly encounter resource not found exception

src/com/android/documentsui/picker/ConfirmFragment.java

diff --git a/src/com/android/documentsui/picker/ConfirmFragment.java b/src/com/android/documentsui/picker/ConfirmFragment.java
index 94015e9..e1af281 100644
--- a/src/com/android/documentsui/picker/ConfirmFragment.java
+++ b/src/com/android/documentsui/picker/ConfirmFragment.java
@@ -32,6 +32,7 @@
 import com.android.documentsui.R;
 import com.android.documentsui.base.DocumentInfo;
 import com.android.documentsui.base.Shared;
+import com.android.modules.utils.build.SdkLevel;
 
 import com.google.android.material.dialog.MaterialAlertDialogBuilder;
 
@@ -102,7 +103,11 @@
         builder.setNegativeButton(android.R.string.cancel,
                 (DialogInterface dialog, int id) -> pickResult.increaseActionCount());
 
-        return builder.create();
+        Dialog dialog = builder.create();
+        if (SdkLevel.isAtLeastS()) {
+            dialog.getWindow().setHideOverlayWindows(true);
+        }
+        return dialog;
     }
 
     @Override