commit b614ab29133b68121a850a2a50c327b46503d35a
author Dmitry Dementyev <dementyev@google.com> Mon Apr 01 20:37:08 2024 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Mon Apr 01 20:37:08 2024 +0000
tree ddef420edd2e38ef69568ff5ec4e21bc88232ef5
parent fd3d8c5342948b45830512cd095396d28a11affd
parent 649ff85e3af1d5b49d54374b6b09a7defabcb386

Merge "Add more checkKeyIntent checks to AccountManagerService." into sc-dev am: 649ff85e3a

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/26720245

Change-Id: I51e031572b6db2c638090ebf2d564e16d6980abe
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

services/core/java/com/android/server/accounts/AccountManagerService.java

diff --git a/services/core/java/com/android/server/accounts/AccountManagerService.java b/services/core/java/com/android/server/accounts/AccountManagerService.java
index d9153fe..43944b0 100644
--- a/services/core/java/com/android/server/accounts/AccountManagerService.java
+++ b/services/core/java/com/android/server/accounts/AccountManagerService.java
@@ -3558,6 +3558,11 @@
 
             // Strip auth token from result.
             result.remove(AccountManager.KEY_AUTHTOKEN);
+            if (!checkKeyIntent(Binder.getCallingUid(), result)) {
+                onError(AccountManager.ERROR_CODE_INVALID_RESPONSE,
+                        "invalid intent in bundle returned");
+                return;
+            }
 
             if (Log.isLoggable(TAG, Log.VERBOSE)) {
                 Log.v(TAG,
@@ -5135,6 +5140,11 @@
                     } else {
                         if (mStripAuthTokenFromResult) {
                             result.remove(AccountManager.KEY_AUTHTOKEN);
+                            if (!checkKeyIntent(Binder.getCallingUid(), result)) {
+                                onError(AccountManager.ERROR_CODE_INVALID_RESPONSE,
+                                        "invalid intent in bundle returned");
+                                return;
+                            }
                         }
                         if (Log.isLoggable(TAG, Log.VERBOSE)) {
                             Log.v(TAG, getClass().getSimpleName()