commit 578a97f4b6a9348d9564427d7fe27a8759cc29ad
author Dmitry Dementyev <dementyev@google.com> Mon Apr 01 21:45:27 2024 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Mon Apr 01 21:45:27 2024 +0000
tree 08ccb5f1f0ccda186ff865623827b273b864b4c7
parent 269fa467d65500448e7d7b16f8acff998a58e804
parent 5f31f2a3317fc8bc7eaea4f7d05bf18682a886af

Merge "Add more checkKeyIntent checks to AccountManagerService." into sc-dev am: 649ff85e3a am: b614ab2913 am: 30ed0c5552 am: 748b1dc959 am: 5f31f2a331

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/26720245

Change-Id: Iee4fe3fb26645c488c4c21ea31ae2de7b93feaf2
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

services/core/java/com/android/server/accounts/AccountManagerService.java

diff --git a/services/core/java/com/android/server/accounts/AccountManagerService.java b/services/core/java/com/android/server/accounts/AccountManagerService.java
index 1c3564b..bc13f10 100644
--- a/services/core/java/com/android/server/accounts/AccountManagerService.java
+++ b/services/core/java/com/android/server/accounts/AccountManagerService.java
@@ -3561,6 +3561,11 @@
 
             // Strip auth token from result.
             result.remove(AccountManager.KEY_AUTHTOKEN);
+            if (!checkKeyIntent(Binder.getCallingUid(), result)) {
+                onError(AccountManager.ERROR_CODE_INVALID_RESPONSE,
+                        "invalid intent in bundle returned");
+                return;
+            }
 
             if (Log.isLoggable(TAG, Log.VERBOSE)) {
                 Log.v(TAG,
@@ -5146,6 +5151,11 @@
                     } else {
                         if (mStripAuthTokenFromResult) {
                             result.remove(AccountManager.KEY_AUTHTOKEN);
+                            if (!checkKeyIntent(Binder.getCallingUid(), result)) {
+                                onError(AccountManager.ERROR_CODE_INVALID_RESPONSE,
+                                        "invalid intent in bundle returned");
+                                return;
+                            }
                         }
                         if (Log.isLoggable(TAG, Log.VERBOSE)) {
                             Log.v(TAG, getClass().getSimpleName()