1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
|
/*
* Copyright (C) 2022 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package android.security.cts.CVE_2022_20501;
import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
import static org.junit.Assert.assertTrue;
import static org.junit.Assume.assumeNoException;
import static org.junit.Assume.assumeNotNull;
import static org.junit.Assume.assumeTrue;
import android.app.UiAutomation;
import android.content.Context;
import android.content.Intent;
import android.content.pm.PackageManager;
import android.content.pm.ResolveInfo;
import android.net.Uri;
import android.os.UserHandle;
import android.provider.Settings;
import androidx.test.runner.AndroidJUnit4;
import androidx.test.uiautomator.By;
import androidx.test.uiautomator.UiDevice;
import androidx.test.uiautomator.Until;
import org.junit.Test;
import org.junit.runner.RunWith;
import java.util.regex.Pattern;
@RunWith(AndroidJUnit4.class)
public class DeviceTest {
private Context mContext;
private void startOverlayService() {
Intent intent = new Intent(mContext, PocService.class);
assumeTrue(mContext.getString(R.string.canNotDrawOverlaysMsg),
Settings.canDrawOverlays(mContext));
mContext.startService(intent);
}
private String getTelecomPkgName() {
PackageManager pm = getInstrumentation().getTargetContext().getPackageManager();
UiAutomation ui = getInstrumentation().getUiAutomation();
String name = mContext.getString(R.string.telecomPkgDefault);
try {
ui.adoptShellPermissionIdentity(android.Manifest.permission.INTERACT_ACROSS_USERS);
Intent intent = new Intent(Intent.ACTION_CALL);
intent.setData(Uri.parse(mContext.getString(R.string.telUri)));
ResolveInfo info = pm.resolveActivityAsUser(intent, PackageManager.MATCH_SYSTEM_ONLY,
UserHandle.USER_SYSTEM);
name = info.activityInfo.packageName;
} catch (Exception e) {
assumeNoException(e);
} finally {
ui.dropShellPermissionIdentity();
}
return name;
}
@Test
public void testOverlayButtonPresence() {
try {
mContext = getApplicationContext();
UiDevice device = UiDevice.getInstance(getInstrumentation());
// Start the overlay service
startOverlayService();
// Wait for the overlay window
Pattern overlayTextPattern = Pattern.compile(
mContext.getString(R.string.overlayButtonText), Pattern.CASE_INSENSITIVE);
final long launchTimeoutMs = 20_000L;
assumeTrue(mContext.getString(R.string.overlayUiScreenError),
device.wait(Until.hasObject(By.text(overlayTextPattern)), launchTimeoutMs));
// Start the vulnerable activity
String pkg = getTelecomPkgName();
String cls = mContext.getString(R.string.vulClsName);
Intent intent = new Intent();
String vulActivity = pkg + cls;
intent.setClassName(pkg, vulActivity);
PackageManager pm = mContext.getPackageManager();
ResolveInfo ri = pm.resolveActivity(intent, PackageManager.MATCH_DEFAULT_ONLY);
assumeNotNull(mContext.getString(R.string.activityNotFoundMsg, intent), ri);
intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
mContext.startActivity(intent);
// Wait until overlay window is gone
boolean overlayDisallowed =
device.wait(Until.gone(By.text(overlayTextPattern)), launchTimeoutMs);
// Check if the currently running activity is the vulnerable activity
String activityDump = device.executeShellCommand(
mContext.getString(R.string.cmdDumpsysActivity, vulActivity));
Pattern activityPattern = Pattern.compile(mContext.getString(R.string.mResumedTrue),
Pattern.CASE_INSENSITIVE);
assumeTrue(mContext.getString(R.string.vulActivityNotRunningError, vulActivity),
activityPattern.matcher(activityDump).find());
// Failing the test as overlay window is being allowed making code vulnerable
assertTrue(mContext.getString(R.string.overlayErrorMessage, vulActivity),
overlayDisallowed);
} catch (Exception e) {
assumeNoException(e);
}
}
}
|
