diff options
| author | Pinyao Ting <pinyaoting@google.com> | 2023-07-24 14:58:56 -0700 |
|---|---|---|
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | 2023-11-09 21:19:36 +0000 |
| commit | 625b46e8557323c482dbb9033e79dc762ec4c09b (patch) | |
| tree | 346f7ad4ecd10804b104e172792d8521fde5bce3 | |
| parent | 19d3600c79c14a3463a8a32fd9817e57a552909d (diff) | |
| download | base-625b46e8557323c482dbb9033e79dc762ec4c09b.tar.gz | |
Validate userId when publishing shortcuts
Bug: 288110451
Test: manual
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:01bfd04ff445db6290ae430d44ea1bf1a115fe3c)
Merged-In: Idbde676f871db83825155730e3714f3727e25762
Change-Id: Idbde676f871db83825155730e3714f3727e25762
| -rw-r--r-- | services/core/java/com/android/server/pm/ShortcutService.java | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/services/core/java/com/android/server/pm/ShortcutService.java b/services/core/java/com/android/server/pm/ShortcutService.java index 3e4dd1637387..c6aba2ab9cbe 100644 --- a/services/core/java/com/android/server/pm/ShortcutService.java +++ b/services/core/java/com/android/server/pm/ShortcutService.java @@ -1743,6 +1743,10 @@ public class ShortcutService extends IShortcutService.Stub { android.util.EventLog.writeEvent(0x534e4554, "109824443", -1, ""); throw new SecurityException("Shortcut package name mismatch"); } + final int callingUid = injectBinderCallingUid(); + if (UserHandle.getUserId(callingUid) != si.getUserId()) { + throw new SecurityException("User-ID in shortcut doesn't match the caller"); + } } private void verifyShortcutInfoPackages( |