diff options
author | Pranav Madapurmath <pmadapurmath@google.com> | 2023-10-06 23:19:18 +0000 |
---|---|---|
committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2023-10-06 23:19:18 +0000 |
commit | 0f844fc06054a7bb5a39b2fc223132705801f00b (patch) | |
tree | 5a6ba513ac68fe96ee5d6150fd1d216e38aa646b | |
parent | 8a92a8f0deaa7ba7f87533dca6e561c601cfe1bf (diff) | |
parent | 733a8f6b8d4dc2cb43a513a06d71c655976266df (diff) | |
download | Telecomm-0f844fc06054a7bb5a39b2fc223132705801f00b.tar.gz |
Resolve account image icon profile boundary exploit. am: a604311f86 am: 13980cb7c8 am: 4603102279 am: 9bbf25ed9e am: a4bc335e6b am: 733a8f6b8d
Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/services/Telecomm/+/24876043
Change-Id: I7b0c354a5ed587362749378d1a8f6d3c8d55de5e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-rw-r--r-- | src/com/android/server/telecom/TelecomServiceImpl.java | 22 | ||||
-rw-r--r-- | tests/src/com/android/server/telecom/tests/TelecomServiceImplTest.java | 21 |
2 files changed, 43 insertions, 0 deletions
diff --git a/src/com/android/server/telecom/TelecomServiceImpl.java b/src/com/android/server/telecom/TelecomServiceImpl.java index ee7aba6c7..576ac1088 100644 --- a/src/com/android/server/telecom/TelecomServiceImpl.java +++ b/src/com/android/server/telecom/TelecomServiceImpl.java @@ -43,6 +43,7 @@ import android.content.pm.ApplicationInfo; import android.content.pm.PackageManager; import android.content.pm.ParceledListSlice; import android.content.pm.ResolveInfo; +import android.graphics.drawable.Icon; import android.net.Uri; import android.os.Binder; import android.os.Build; @@ -599,6 +600,9 @@ public class TelecomServiceImpl { .build(); } + // Validate the profile boundary of the given image URI. + validateAccountIconUserBoundary(account.getIcon()); + final long token = Binder.clearCallingIdentity(); try { mPhoneAccountRegistrar.registerPhoneAccount(account); @@ -2752,4 +2756,22 @@ public class TelecomServiceImpl { mContext.sendBroadcast(intent); } } + + private void validateAccountIconUserBoundary(Icon icon) { + // Refer to Icon#getUriString for context. The URI string is invalid for icons of + // incompatible types. + if (icon != null && (icon.getType() == Icon.TYPE_URI + || icon.getType() == Icon.TYPE_URI_ADAPTIVE_BITMAP)) { + String encodedUser = icon.getUri().getEncodedUserInfo(); + // If there is no encoded user, the URI is calling into the calling user space + if (encodedUser != null) { + int userId = Integer.parseInt(encodedUser); + if (userId != UserHandle.getUserId(Binder.getCallingUid())) { + // If we are transcending the profile boundary, throw an error. + throw new IllegalArgumentException("Attempting to register a phone account with" + + " an image icon belonging to another user."); + } + } + } + } } diff --git a/tests/src/com/android/server/telecom/tests/TelecomServiceImplTest.java b/tests/src/com/android/server/telecom/tests/TelecomServiceImplTest.java index 90bdc802f..2d2b4bcc1 100644 --- a/tests/src/com/android/server/telecom/tests/TelecomServiceImplTest.java +++ b/tests/src/com/android/server/telecom/tests/TelecomServiceImplTest.java @@ -31,6 +31,7 @@ import android.content.Context; import android.content.Intent; import android.content.pm.ApplicationInfo; import android.content.pm.PackageManager; +import android.graphics.drawable.Icon; import android.net.Uri; import android.os.Binder; import android.os.Build; @@ -619,6 +620,26 @@ public class TelecomServiceImplTest extends TelecomTestCase { @SmallTest @Test + public void testRegisterPhoneAccountImageIconCrossUser() throws RemoteException { + String packageNameToUse = "com.android.officialpackage"; + PhoneAccountHandle phHandle = new PhoneAccountHandle(new ComponentName( + packageNameToUse, "cs"), "test", Binder.getCallingUserHandle()); + Icon icon = Icon.createWithContentUri("content://10@media/external/images/media/"); + PhoneAccount phoneAccount = makePhoneAccount(phHandle).setIcon(icon).build(); + doReturn(PackageManager.PERMISSION_GRANTED) + .when(mContext).checkCallingOrSelfPermission(MODIFY_PHONE_STATE); + + // This should fail; security exception will be thrown. + registerPhoneAccountTestHelper(phoneAccount, false); + + icon = Icon.createWithContentUri("content://0@media/external/images/media/"); + phoneAccount = makePhoneAccount(phHandle).setIcon(icon).build(); + // This should succeed. + registerPhoneAccountTestHelper(phoneAccount, true); + } + + @SmallTest + @Test public void testUnregisterPhoneAccount() throws RemoteException { String packageNameToUse = "com.android.officialpackage"; PhoneAccountHandle phHandle = new PhoneAccountHandle(new ComponentName( |