commit bd8881739d3a318cad4e2bef60b03547dd14715c
author Stephanie Bak <dasol@google.com> Tue Aug 31 03:51:03 2021 +0000
committer Stephanie Bak <dasol@google.com> Tue Aug 31 20:08:37 2021 +0000
tree 0f68f2b908e284c10e54219f9a736d74dbef0aca
parent 8dad7a9b48558713c6095eea5a9f2cfeb37e331e

Add uid/package check in WifiServiceImpl#getConfiguredNetworks

Enforce UID to package name check to validate that the caller isn't
providing a fake packageName which isn't their own.

Bug: 197749180
Test: atest com.android.server.wifi
Change-Id: Ia8530b0b8de8de87932844439bb56da43aef4387
(cherry picked from commit 7d8276552fab89d27ca496031dbb94950e75d6a6)

service/java/com/android/server/wifi/WifiServiceImpl.java

diff --git a/service/java/com/android/server/wifi/WifiServiceImpl.java b/service/java/com/android/server/wifi/WifiServiceImpl.java
index d433787..eff52a4 100644
--- a/service/java/com/android/server/wifi/WifiServiceImpl.java
+++ b/service/java/com/android/server/wifi/WifiServiceImpl.java
@@ -2447,6 +2447,7 @@
             String featureId, boolean callerNetworksOnly) {
         enforceAccessPermission();
         int callingUid = Binder.getCallingUid();
+        mWifiPermissionsUtil.checkPackage(callingUid, packageName);
         boolean isDeviceOrProfileOwner = isDeviceOrProfileOwner(callingUid, packageName);
         boolean isCarrierApp = mWifiInjector.makeTelephonyManager()
                 .checkCarrierPrivilegesForPackageAnyPhone(packageName)