From 2fc9fed89c2a0f0e7b2ccad9c5cf899bc6ccc4cf Mon Sep 17 00:00:00 2001 From: Tsung-Mao Fang Date: Wed, 4 Mar 2020 18:18:41 +0800 Subject: [PATCH] Fix pendingIntent in SettingsSliceProvider could be Hijacked A malicious app is able to obtain this pending intent. It can then mutate all fields except for the action and launch the intent. This can be used to launch any activity with the ACTION_SETTINGS action. So, we enfore assign the package name for this intent, it only can launch the settings app. Fix: 147355897 Test: a) Install the new settings apk, and it won't launch other screen. (See details in bug) b) Start the settings search, slice search results work as normal. Change-Id: Ie954d8a4b7153d6a4cac40621f363b45185990f2 (cherry picked from commit b3c0a2a6c1ce4eaa0853101506760f87121d4b99) Merged-In: Ie954d8a4b7153d6a4cac40621f363b45185990f2 --- src/com/android/settings/slices/SettingsSliceProvider.java | 4 +++- .../android/settings/slices/SettingsSliceProviderTest.java | 5 ++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/src/com/android/settings/slices/SettingsSliceProvider.java b/src/com/android/settings/slices/SettingsSliceProvider.java index bed0532f89e..0aaf85d143a 100644 --- a/src/com/android/settings/slices/SettingsSliceProvider.java +++ b/src/com/android/settings/slices/SettingsSliceProvider.java @@ -44,6 +44,7 @@ import androidx.slice.SliceProvider; import com.android.settings.R; +import com.android.settings.Utils; import com.android.settings.bluetooth.BluetoothSliceBuilder; import com.android.settings.core.BasePreferenceController; import com.android.settings.notification.zen.ZenModeSliceBuilder; @@ -322,7 +323,8 @@ public Collection onGetSliceDescendants(Uri uri) { @Override public PendingIntent onCreatePermissionRequest(@NonNull Uri sliceUri, @NonNull String callingPackage) { - final Intent settingsIntent = new Intent(Settings.ACTION_SETTINGS); + final Intent settingsIntent = new Intent(Settings.ACTION_SETTINGS) + .setPackage(Utils.SETTINGS_PACKAGE_NAME); final PendingIntent noOpIntent = PendingIntent.getActivity(getContext(), 0 /* requestCode */, settingsIntent, 0 /* flags */); return noOpIntent; diff --git a/tests/robotests/src/com/android/settings/slices/SettingsSliceProviderTest.java b/tests/robotests/src/com/android/settings/slices/SettingsSliceProviderTest.java index a969420cc65..0a9d8cbe83d 100644 --- a/tests/robotests/src/com/android/settings/slices/SettingsSliceProviderTest.java +++ b/tests/robotests/src/com/android/settings/slices/SettingsSliceProviderTest.java @@ -50,6 +50,7 @@ import androidx.slice.SliceProvider; import androidx.slice.widget.SliceLiveData; +import com.android.settings.Utils; import com.android.settings.testutils.DatabaseTestUtils; import com.android.settings.testutils.FakeToggleController; import com.android.settings.testutils.shadow.ShadowBluetoothAdapter; @@ -530,8 +531,10 @@ public void getDescendantUris_privateSlicesNotNeeded_notContainPrivateSliceUri() public void onCreatePermissionRequest_returnsSettingIntent() { final PendingIntent pendingIntent = mProvider.onCreatePermissionRequest( CustomSliceRegistry.FLASHLIGHT_SLICE_URI, "com.android.whaaaat"); + final Intent settingsIntent = new Intent(Settings.ACTION_SETTINGS) + .setPackage(Utils.SETTINGS_PACKAGE_NAME); PendingIntent settingsPendingIntent = - PendingIntent.getActivity(mContext, 0, new Intent(Settings.ACTION_SETTINGS), 0); + PendingIntent.getActivity(mContext, 0, settingsIntent, 0); assertThat(pendingIntent).isEqualTo(settingsPendingIntent); }