LineageOS/android_development
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use the flag FLAG_MUTABLE when creating the PendingIntent

Browse Source 
Starting with S, any app targeting S+ will need to specify
explicitly either FLAG_MUTABLE or FLAG_IMMUTABLE when creating
PendingIntents.

This change helps mitigate against implicit PendingIntent reuse.
At present, all PendingIntents are mutable by default unless
FLAG_IMMUTABLE is explicitly set when creating them. This often
leads to developers accidentally making the PendingIntents mutable
and thus handing their receivers powers to fill in critical fields.

Because the autofill system server will need to update it, the
PendingIntent from the service provider (AwG, AiAi etc) should be
mutable.

Bug: 170771150
Test: manual. Make sure the function works normal.

Change-Id: I52e7e0924103447ff8e4bad553539c7b1dba34af
This commit is contained in:
Joanne Chung
2020-11-02 23:13:44 +08:00
parent f634d35723
commit f363525b73
2 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
samples/InlineFillService/src/com/example/android/inlinefillservice/AuthActivity.java
View File

@@ -114,6 +114,6 @@ public class AuthActivity extends Activity {
}
return PendingIntent.getActivity(context, ++sPendingIntentId, intent,
PendingIntent.FLAG_CANCEL_CURRENT).getIntentSender();
PendingIntent.FLAG_CANCEL_CURRENT | PendingIntent.FLAG_MUTABLE).getIntentSender();
}
}

7
samples/InlineFillService/src/com/example/android/inlinefillservice/InlineRequestHelper.java
View File

@@ -79,7 +79,7 @@ public class InlineRequestHelper {
InlineSuggestionsRequest inlineRequest, int drawable) {
PendingIntent pendingIntent =
PendingIntent.getActivity(context, 0, new Intent(context, SettingsActivity.class),
PendingIntent.FLAG_UPDATE_CURRENT);
PendingIntent.FLAG_UPDATE_CURRENT | PendingIntent.FLAG_MUTABLE);
Dataset.Builder builder =
new Dataset.Builder()
@@ -126,9 +126,8 @@ public class InlineRequestHelper {
Intent intent = new Intent(context, AttributionDialogActivity.class);
intent.putExtra(AttributionDialogActivity.KEY_MSG, msg);
// Should use different request code to avoid the new intent overriding the old one.
PendingIntent pendingIntent =
PendingIntent.getActivity(
context, msg.hashCode(), intent, PendingIntent.FLAG_UPDATE_CURRENT);
PendingIntent pendingIntent = PendingIntent.getActivity(context, msg.hashCode(), intent,
PendingIntent.FLAG_UPDATE_CURRENT | PendingIntent.FLAG_MUTABLE);
return pendingIntent;
}