Merge "Fix pendingIntent in SettingsSliceProvider could be Hijacked" …

…into rvc-dev
Los-FE · Mar 5, 2020 · e8f1c6c · e8f1c6c
2 parents 5578920 + 2fc9fed
commit e8f1c6c
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/src/com/android/settings/slices/SettingsSliceProvider.java b/src/com/android/settings/slices/SettingsSliceProvider.java
@@ -44,6 +44,7 @@
 import androidx.slice.SliceProvider;
 
 import com.android.settings.R;
+import com.android.settings.Utils;
 import com.android.settings.bluetooth.BluetoothSliceBuilder;
 import com.android.settings.core.BasePreferenceController;
 import com.android.settings.notification.zen.ZenModeSliceBuilder;
@@ -322,7 +323,8 @@ public Collection<Uri> onGetSliceDescendants(Uri uri) {
     @Override
     public PendingIntent onCreatePermissionRequest(@NonNull Uri sliceUri,
             @NonNull String callingPackage) {
-        final Intent settingsIntent = new Intent(Settings.ACTION_SETTINGS);
+        final Intent settingsIntent = new Intent(Settings.ACTION_SETTINGS)
+                .setPackage(Utils.SETTINGS_PACKAGE_NAME);
         final PendingIntent noOpIntent = PendingIntent.getActivity(getContext(),
                 0 /* requestCode */, settingsIntent, 0 /* flags */);
         return noOpIntent;

diff --git a/tests/robotests/src/com/android/settings/slices/SettingsSliceProviderTest.java b/tests/robotests/src/com/android/settings/slices/SettingsSliceProviderTest.java
@@ -50,6 +50,7 @@
 import androidx.slice.SliceProvider;
 import androidx.slice.widget.SliceLiveData;
 
+import com.android.settings.Utils;
 import com.android.settings.testutils.DatabaseTestUtils;
 import com.android.settings.testutils.FakeToggleController;
 import com.android.settings.testutils.shadow.ShadowBluetoothAdapter;
@@ -530,8 +531,10 @@ public void getDescendantUris_privateSlicesNotNeeded_notContainPrivateSliceUri()
     public void onCreatePermissionRequest_returnsSettingIntent() {
         final PendingIntent pendingIntent = mProvider.onCreatePermissionRequest(
                 CustomSliceRegistry.FLASHLIGHT_SLICE_URI, "com.android.whaaaat");
+        final Intent settingsIntent = new Intent(Settings.ACTION_SETTINGS)
+                .setPackage(Utils.SETTINGS_PACKAGE_NAME);
         PendingIntent settingsPendingIntent =
-                PendingIntent.getActivity(mContext, 0, new Intent(Settings.ACTION_SETTINGS), 0);
+                PendingIntent.getActivity(mContext, 0, settingsIntent, 0);
 
         assertThat(pendingIntent).isEqualTo(settingsPendingIntent);
     }