openkylin
/
platform_packages_apps_Launcher3
mirror of https://gitee.com/openkylin/platform_packages_apps_launcher3.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Address SessionCommitReceiver vulnerability by validating intent. 

Bug: 144081762
Change-Id: I28699d26abefc716e57c281c15699f15003229b2
This commit is contained in:
Jon Miranda 2019-11-08 13:02:52 -08:00
parent f788bbb0c4
commit 7e04887e59
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/com/android/launcher3/SessionCommitReceiver.java
View File

@ -71,8 +71,13 @@ public class SessionCommitReceiver extends BroadcastReceiver {
SessionInfo info = intent.getParcelableExtra(PackageInstaller.EXTRA_SESSION);
UserHandle user = intent.getParcelableExtra(Intent.EXTRA_USER);
PackageInstallerCompat packageInstallerCompat = PackageInstallerCompat.getInstance(context);
if (!PackageInstaller.ACTION_SESSION_COMMITTED.equals(intent.getAction())
|| info == null || user == null) {
// Invalid intent.
return;
}
PackageInstallerCompat packageInstallerCompat = PackageInstallerCompat.getInstance(context);
if (TextUtils.isEmpty(info.getAppPackageName())
|| info.getInstallReason() != PackageManager.INSTALL_REASON_USER
|| packageInstallerCompat.promiseIconAddedForId(info.getSessionId())) {