diff options
author | TreeHugger Robot <treehugger-gerrit@google.com> | 2022-09-06 15:34:43 +0000 |
---|---|---|
committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2022-09-06 15:34:43 +0000 |
commit | 9f864c4b23691e7a94f798f3bff93095df734ee7 (patch) | |
tree | 333e41a5cd89fd0ffac2c0295713d310781e8d81 | |
parent | b5e74c1c7e3e488a39b5343a3239ae93e09cf0b6 (diff) | |
parent | 0b5ceb8cd2cb2e1fc9a274a711f49698d152d119 (diff) | |
download | base-9f864c4b23691e7a94f798f3bff93095df734ee7.tar.gz |
Merge "Validate package name passed to setApplicationRestrictions." into qt-dev am: 0b5ceb8cd2
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/19747771
Change-Id: Ie6bc78bc892b8ae40b1acb095cbb2a49ee3d0452
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-rw-r--r-- | services/core/java/com/android/server/pm/UserManagerService.java | 41 | ||||
-rw-r--r-- | services/tests/servicestests/src/com/android/server/pm/UserManagerServiceTest.java | 7 |
2 files changed, 48 insertions, 0 deletions
diff --git a/services/core/java/com/android/server/pm/UserManagerService.java b/services/core/java/com/android/server/pm/UserManagerService.java index ebd967f3c87d..6880918df5b4 100644 --- a/services/core/java/com/android/server/pm/UserManagerService.java +++ b/services/core/java/com/android/server/pm/UserManagerService.java @@ -80,6 +80,7 @@ import android.security.GateKeeper; import android.service.gatekeeper.IGateKeeperService; import android.stats.devicepolicy.DevicePolicyEnums; import android.util.AtomicFile; +import android.util.EventLog; import android.util.IntArray; import android.util.Log; import android.util.Slog; @@ -3424,6 +3425,13 @@ public class UserManagerService extends IUserManager.Stub { public void setApplicationRestrictions(String packageName, Bundle restrictions, int userId) { checkSystemOrRoot("set application restrictions"); + String validationResult = validateName(packageName); + if (validationResult != null) { + if (packageName.contains("../")) { + EventLog.writeEvent(0x534e4554, "239701237", -1, ""); + } + throw new IllegalArgumentException("Invalid package name: " + validationResult); + } if (restrictions != null) { restrictions.setDefusable(true); } @@ -3443,6 +3451,39 @@ public class UserManagerService extends IUserManager.Stub { mContext.sendBroadcastAsUser(changeIntent, UserHandle.of(userId)); } + /** + * Check if the given name is valid. + * + * Note: the logic is taken from FrameworkParsingPackageUtils in master, edited to remove + * unnecessary parts. Copied here for a security fix. + * + * @param name The name to check. + * @return null if it's valid, error message if not + */ + @VisibleForTesting + static String validateName(String name) { + final int n = name.length(); + boolean front = true; + for (int i = 0; i < n; i++) { + final char c = name.charAt(i); + if ((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')) { + front = false; + continue; + } + if (!front) { + if ((c >= '0' && c <= '9') || c == '_') { + continue; + } + if (c == '.') { + front = true; + continue; + } + } + return "bad character '" + c + "'"; + } + return null; + } + private int getUidForPackage(String packageName) { long ident = Binder.clearCallingIdentity(); try { diff --git a/services/tests/servicestests/src/com/android/server/pm/UserManagerServiceTest.java b/services/tests/servicestests/src/com/android/server/pm/UserManagerServiceTest.java index d1366144d33b..8da7a76f18ce 100644 --- a/services/tests/servicestests/src/com/android/server/pm/UserManagerServiceTest.java +++ b/services/tests/servicestests/src/com/android/server/pm/UserManagerServiceTest.java @@ -74,6 +74,13 @@ public class UserManagerServiceTest extends AndroidTestCase { assertEquals(accountName, um.getUserAccount(tempUserId)); } + public void testValidateName() { + assertNull(UserManagerService.validateName("android")); + assertNull(UserManagerService.validateName("com.company.myapp")); + assertNotNull(UserManagerService.validateName("/../../data")); + assertNotNull(UserManagerService.validateName("/dir")); + } + private Bundle createBundle() { Bundle result = new Bundle(); // Tests for 6 allowed types: Integer, Boolean, String, String[], Bundle and Parcelable[] |