commit 30ed0c5552ab4002cca8efc245110e39fab5d21f
author Dmitry Dementyev <dementyev@google.com> Mon Apr 01 20:54:04 2024 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Mon Apr 01 20:54:04 2024 +0000
tree 39ec9617c6d6cb043f60a8e155225870987bb96c
parent f84dc1ff0a4bc472f754a5c17ad4ba6bea77656d
parent b614ab29133b68121a850a2a50c327b46503d35a

Merge "Add more checkKeyIntent checks to AccountManagerService." into sc-dev am: 649ff85e3a am: b614ab2913

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/26720245

Change-Id: Ib66e99593d0cd4fa378dd0609e63b5477d254b8a
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

services/core/java/com/android/server/accounts/AccountManagerService.java

diff --git a/services/core/java/com/android/server/accounts/AccountManagerService.java b/services/core/java/com/android/server/accounts/AccountManagerService.java
index d9153fe..43944b0 100644
--- a/services/core/java/com/android/server/accounts/AccountManagerService.java
+++ b/services/core/java/com/android/server/accounts/AccountManagerService.java
@@ -3558,6 +3558,11 @@
 
             // Strip auth token from result.
             result.remove(AccountManager.KEY_AUTHTOKEN);
+            if (!checkKeyIntent(Binder.getCallingUid(), result)) {
+                onError(AccountManager.ERROR_CODE_INVALID_RESPONSE,
+                        "invalid intent in bundle returned");
+                return;
+            }
 
             if (Log.isLoggable(TAG, Log.VERBOSE)) {
                 Log.v(TAG,
@@ -5135,6 +5140,11 @@
                     } else {
                         if (mStripAuthTokenFromResult) {
                             result.remove(AccountManager.KEY_AUTHTOKEN);
+                            if (!checkKeyIntent(Binder.getCallingUid(), result)) {
+                                onError(AccountManager.ERROR_CODE_INVALID_RESPONSE,
+                                        "invalid intent in bundle returned");
+                                return;
+                            }
                         }
                         if (Log.isLoggable(TAG, Log.VERBOSE)) {
                             Log.v(TAG, getClass().getSimpleName()