diff options
| author | Louis Chang <louischang@google.com> | 2022-08-02 03:33:39 +0000 |
|---|---|---|
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | 2022-09-10 12:34:48 +0000 |
| commit | e78a2b4a2ef88570c0b9c0052189b4f13b844f3b (patch) | |
| tree | d16afa7e02ce0c8f5f6af02acee79a141778bd79 | |
| parent | d48e19edb6fa79dc7e870022a7ebf98f7f15a824 (diff) | |
| download | base-e78a2b4a2ef88570c0b9c0052189b4f13b844f3b.tar.gz | |
[RESTRICT AUTOMERGE] Do not send new Intent to non-exported activity when navigateUpTo
The new Intent was delivered to a non-exported activity while
#navigateUpTo was called from an Activity of a different uid.
Bug: 238605611
Test: atest StartActivityTests
Change-Id: I854dd825bfd9a2c08851980d480d1f3a177af6cf
Merged-In: I854dd825bfd9a2c08851980d480d1f3a177af6cf
(cherry picked from commit b9a934064598aa655fab4ce75c8eab6165409670)
Merged-In: I854dd825bfd9a2c08851980d480d1f3a177af6cf
| -rw-r--r-- | services/core/java/com/android/server/wm/ActivityStack.java | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/services/core/java/com/android/server/wm/ActivityStack.java b/services/core/java/com/android/server/wm/ActivityStack.java index 81fbcbf093c0..75af02b79644 100644 --- a/services/core/java/com/android/server/wm/ActivityStack.java +++ b/services/core/java/com/android/server/wm/ActivityStack.java @@ -4308,7 +4308,23 @@ class ActivityStack extends ConfigurationContainer { parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TASK || parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TOP || (destIntentFlags & Intent.FLAG_ACTIVITY_CLEAR_TOP) != 0) { - parent.deliverNewIntentLocked(callingUid, destIntent, srec.packageName); + boolean abort; + try { + final int callingPid = srec.app != null ? srec.app.getPid() : 0; + abort = !mStackSupervisor.checkStartAnyActivityPermission(destIntent, + parent.info, null /* resultWho */, -1 /* requestCode */, callingPid, + callingUid, srec.info.packageName, false /* ignoreTargetSecurity */, + false /* launchingInTask */, srec.app, null /* resultRecord */, + null /* resultRootTask */); + } catch (SecurityException e) { + abort = true; + } + if (abort) { + android.util.EventLog.writeEvent(0x534e4554, "238605611", callingUid, ""); + foundParentInTask = false; + } else { + parent.deliverNewIntentLocked(callingUid, destIntent, srec.packageName); + } } else { try { ActivityInfo aInfo = AppGlobals.getPackageManager().getActivityInfo( |