diff options
| author | Raphael Kim <raphk@google.com> | 2023-09-18 14:07:23 -0700 |
|---|---|---|
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | 2023-11-10 18:29:26 +0000 |
| commit | 74d17f63ec61216187f11d78d00c3f2359f5e5eb (patch) | |
| tree | 867177a13df486f5d553f2cf1fd43af494f94aec | |
| parent | b8331285ad4fbc62ef5f5486eee2fbd8aed29df2 (diff) | |
| download | base-74d17f63ec61216187f11d78d00c3f2359f5e5eb.tar.gz | |
[CDM] Validate component name length before requesting notification access.
Bug: 295335110
Test: Test app with long component name
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:e10f7d34dd843032e9d081e5a49e70f9d5d64bb6)
Merged-In: I7ea5d5c1f78858db9865f3310d1e0aff9c8b5579
Change-Id: I7ea5d5c1f78858db9865f3310d1e0aff9c8b5579
| -rw-r--r-- | services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java b/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java index 611541f671cf..0a617cdd2168 100644 --- a/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java +++ b/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java @@ -144,6 +144,7 @@ public class CompanionDeviceManagerService extends SystemService { "debug.cdm.cdmservice.removal_time_window"; private static final long ASSOCIATION_REMOVAL_TIME_WINDOW_DEFAULT = DAYS.toMillis(90); + private static final int MAX_CN_LENGTH = 500; private final ActivityManager mActivityManager; private final OnPackageVisibilityChangeListener mOnPackageVisibilityChangeListener; @@ -686,6 +687,9 @@ public class CompanionDeviceManagerService extends SystemService { String callingPackage = component.getPackageName(); checkCanCallNotificationApi(callingPackage); // TODO: check userId. + if (component.flattenToString().length() > MAX_CN_LENGTH) { + throw new IllegalArgumentException("Component name is too long."); + } final long identity = Binder.clearCallingIdentity(); try { return PendingIntent.getActivityAsUser(getContext(), |