Google Git
Sign in
android/platform/packages/apps/ManagedProvisioning/d33d045407c5bd0000442667d9ef5c9fc3f590e5
commit
d33d045407c5bd0000442667d9ef5c9fc3f590e5
[log]
author
Shreya Singh <shreyacsingh@google.com>
Fri Mar 07 16:15:57 2025 -0800
committer
Android Build Coastguard Worker <android-build-coastguard-worker@google.com>
Wed Apr 09 15:19:38 2025 -0700
tree
8a2f3606710d50e5ed387601b6aa78277b53d69f
parent
a3172895010e1253a6070b6414c2398a1ed6d886 [diff]
Fix confused deputy vulnerability in termsActivity to access terms_disclaimer Uri only if the calling app has the permissions

1-P doc at: go/termsDisclaimerVulnerability

Before: https://hsv.googleplex.com/5163551739084800
After: https://hsv.googleplex.com/5207829722955776
https://paste.googleplex.com/5643054726512640

Flag: EXEMPT bug fix
Bug: 299928772
Test: Manual using test app provided by the reporter
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:5d67902f6a7498d016ee588d6c00710fb2d3ab98)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:68ff8bc959c104f1803e8b5e04ee180aaa542992)
Merged-In: I4c5ab64cb770c61db1cedc5169a4b8cdf0a4b0bd
Change-Id: I4c5ab64cb770c61db1cedc5169a4b8cdf0a4b0bd
1 file changed
tree: 8a2f3606710d50e5ed387601b6aa78277b53d69f
  1. .idea/
  2. aconfig/
  3. proto/
  4. res/
  5. src/
  6. studio-dev/
  7. tests/
  8. tools/
  9. Android.bp
  10. AndroidManifest.xml
  11. OWNERS
  12. PREUPLOAD.cfg
  13. proguard.flags
  14. README.md
  15. TEST_MAPPING
README.md

Managed Provisioning

Bundled app responsible for provisioning an enterprise device

Flows

QR

{
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_COMPONENT_NAME": "com.afwsamples.testdpc/com.afwsamples.testdpc.DeviceAdminReceiver",
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_PACKAGE_DOWNLOAD_LOCATION": "https://testdpc-latest-apk.appspot.com/preview",
  "android.app.extra.PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM": "gJD2YwtOiWJHkSMkkIfLRlj-quNqG1fb6v100QmzM9w="
}

Code

AS Setup

aidegen -n -i=s -p=/opt/android-studio-with-blaze-canary \
    packages/apps/ManagedProvisioning \
    frameworks/base \
    cts \
    vendor/xts \
    packages/apps/Settings \
    vendor/unbundled_google/packages/SettingsGoogle \
    external/connectedappssdk \
    packages/services/Car/packages/CarManagedProvisioning \
    vendor/google/apps/SetupWizardOverlay/PixelSetupWizard

References