Prevent tapjacking in Pia V2
The positive buttons of dialogs that need user confirmation should
filter touches when they are obscured. Also for added safety, disable
the positve buttons when Pia is paused.
Bug: 316553266
Test: atest CtsPackageInstallerTapjackingTestCases
Change-Id: Icda99fff494275c143ebf75c3982588f7ac5c614
diff --git a/packages/PackageInstaller/src/com/android/packageinstaller/v2/ui/fragments/AnonymousSourceFragment.java b/packages/PackageInstaller/src/com/android/packageinstaller/v2/ui/fragments/AnonymousSourceFragment.java
index 6d6fcc9..491716e 100644
--- a/packages/PackageInstaller/src/com/android/packageinstaller/v2/ui/fragments/AnonymousSourceFragment.java
+++ b/packages/PackageInstaller/src/com/android/packageinstaller/v2/ui/fragments/AnonymousSourceFragment.java
@@ -34,7 +34,10 @@
public class AnonymousSourceFragment extends DialogFragment {
public static String TAG = AnonymousSourceFragment.class.getSimpleName();
+ @NonNull
private InstallActionListener mInstallActionListener;
+ @NonNull
+ private AlertDialog mDialog;
@Override
public void onAttach(@NonNull Context context) {
@@ -45,7 +48,7 @@
@NonNull
@Override
public Dialog onCreateDialog(Bundle savedInstanceState) {
- return new AlertDialog.Builder(getActivity())
+ mDialog = new AlertDialog.Builder(requireContext())
.setMessage(R.string.anonymous_source_warning)
.setPositiveButton(R.string.anonymous_source_continue,
((dialog, which) -> mInstallActionListener.onPositiveResponse(
@@ -53,6 +56,7 @@
.setNegativeButton(R.string.cancel,
((dialog, which) -> mInstallActionListener.onNegativeResponse(
InstallStage.STAGE_USER_ACTION_REQUIRED))).create();
+ return mDialog;
}
@Override
@@ -60,4 +64,24 @@
super.onCancel(dialog);
mInstallActionListener.onNegativeResponse(InstallStage.STAGE_USER_ACTION_REQUIRED);
}
+
+ @Override
+ public void onStart() {
+ super.onStart();
+ mDialog.getButton(DialogInterface.BUTTON_POSITIVE).setFilterTouchesWhenObscured(true);
+ }
+
+ @Override
+ public void onPause() {
+ super.onPause();
+ // This prevents tapjacking since an overlay activity started in front of Pia will
+ // cause Pia to be paused.
+ mDialog.getButton(DialogInterface.BUTTON_POSITIVE).setEnabled(false);
+ }
+
+ @Override
+ public void onResume() {
+ super.onResume();
+ mDialog.getButton(DialogInterface.BUTTON_POSITIVE).setEnabled(true);
+ }
}
diff --git a/packages/PackageInstaller/src/com/android/packageinstaller/v2/ui/fragments/ExternalSourcesBlockedFragment.java b/packages/PackageInstaller/src/com/android/packageinstaller/v2/ui/fragments/ExternalSourcesBlockedFragment.java
index 4cdce52..a0ad362 100644
--- a/packages/PackageInstaller/src/com/android/packageinstaller/v2/ui/fragments/ExternalSourcesBlockedFragment.java
+++ b/packages/PackageInstaller/src/com/android/packageinstaller/v2/ui/fragments/ExternalSourcesBlockedFragment.java
@@ -35,8 +35,12 @@
public class ExternalSourcesBlockedFragment extends DialogFragment {
private final String TAG = ExternalSourcesBlockedFragment.class.getSimpleName();
+ @NonNull
private final InstallUserActionRequired mDialogData;
+ @NonNull
private InstallActionListener mInstallActionListener;
+ @NonNull
+ private AlertDialog mDialog;
public ExternalSourcesBlockedFragment(InstallUserActionRequired dialogData) {
mDialogData = dialogData;
@@ -51,7 +55,7 @@
@NonNull
@Override
public Dialog onCreateDialog(@Nullable Bundle savedInstanceState) {
- return new AlertDialog.Builder(requireContext())
+ mDialog = new AlertDialog.Builder(requireContext())
.setTitle(mDialogData.getAppLabel())
.setIcon(mDialogData.getAppIcon())
.setMessage(R.string.untrusted_external_source_warning)
@@ -62,6 +66,7 @@
(dialog, which) -> mInstallActionListener.onNegativeResponse(
mDialogData.getStageCode()))
.create();
+ return mDialog;
}
@Override
@@ -69,4 +74,24 @@
super.onCancel(dialog);
mInstallActionListener.onNegativeResponse(mDialogData.getStageCode());
}
+
+ @Override
+ public void onStart() {
+ super.onStart();
+ mDialog.getButton(DialogInterface.BUTTON_POSITIVE).setFilterTouchesWhenObscured(true);
+ }
+
+ @Override
+ public void onPause() {
+ super.onPause();
+ // This prevents tapjacking since an overlay activity started in front of Pia will
+ // cause Pia to be paused.
+ mDialog.getButton(DialogInterface.BUTTON_POSITIVE).setEnabled(false);
+ }
+
+ @Override
+ public void onResume() {
+ super.onResume();
+ mDialog.getButton(DialogInterface.BUTTON_POSITIVE).setEnabled(true);
+ }
}
diff --git a/packages/PackageInstaller/src/com/android/packageinstaller/v2/ui/fragments/InstallConfirmationFragment.java b/packages/PackageInstaller/src/com/android/packageinstaller/v2/ui/fragments/InstallConfirmationFragment.java
index 6398aef..42d4dfa 100644
--- a/packages/PackageInstaller/src/com/android/packageinstaller/v2/ui/fragments/InstallConfirmationFragment.java
+++ b/packages/PackageInstaller/src/com/android/packageinstaller/v2/ui/fragments/InstallConfirmationFragment.java
@@ -42,6 +42,8 @@
private final InstallUserActionRequired mDialogData;
@NonNull
private InstallActionListener mInstallActionListener;
+ @NonNull
+ private AlertDialog mDialog;
public InstallConfirmationFragment(@NonNull InstallUserActionRequired dialogData) {
mDialogData = dialogData;
@@ -58,7 +60,7 @@
public Dialog onCreateDialog(@Nullable Bundle savedInstanceState) {
View dialogView = getLayoutInflater().inflate(R.layout.install_content_view, null);
- AlertDialog dialog = new AlertDialog.Builder(requireContext())
+ mDialog = new AlertDialog.Builder(requireContext())
.setIcon(mDialogData.getAppIcon())
.setTitle(mDialogData.getAppLabel())
.setView(dialogView)
@@ -84,7 +86,7 @@
}
viewToEnable.setVisibility(View.VISIBLE);
- return dialog;
+ return mDialog;
}
@Override
@@ -92,4 +94,24 @@
super.onCancel(dialog);
mInstallActionListener.onNegativeResponse(mDialogData.getStageCode());
}
+
+ @Override
+ public void onStart() {
+ super.onStart();
+ mDialog.getButton(DialogInterface.BUTTON_POSITIVE).setFilterTouchesWhenObscured(true);
+ }
+
+ @Override
+ public void onPause() {
+ super.onPause();
+ // This prevents tapjacking since an overlay activity started in front of Pia will
+ // cause Pia to be paused.
+ mDialog.getButton(DialogInterface.BUTTON_POSITIVE).setEnabled(false);
+ }
+
+ @Override
+ public void onResume() {
+ super.onResume();
+ mDialog.getButton(DialogInterface.BUTTON_POSITIVE).setEnabled(true);
+ }
}