tree 4f1a4b40d76233b2b114da20ba053fbef365df28
parent 42be5cfa1029ff3e3f451289b3368631ed77f4fb
author Hugh Chen <hughchen@google.com> 1615516820 +0800
committer android-build-team Robot <android-build-team-robot@google.com> 1621468897 +0000

RESTRICT AUTOMERGE Fix bluetooth settings will broadcast to anywhere when some cases

BluetoothPermissionActivity and DevicePickerFragment will send
broadcast to return the result to calling apps. As this broadcast
intent is from Settings with uid 1000, it will be sent to any
protected BroadcastReceivers in the device. It can make an attacker
send broadcast to protected BroadcastReceivers like factory reset intent
(android/com.android.server.MasterClearReceiver) via
BluetoothPermissionActivity or DevicePickerFragment.

This CL will not allow to set package name and class name to avoid
the attacker.

Bug: 179386960
Bug: 179386068
Test: make -j42 RunSettingsRoboTests and use test apk to manually test
to verify factory reset not started and no system UI notification.

Change-Id: Id27a78091ab578077853b8fbb97a4422cff0a158
(cherry picked from commit 8adedc62496cf8cf6ecfc6ccf23b0b248081d7d4)
(cherry picked from commit e21d06f6eeb20cdd0c6e2a995f27e942225fb807)