am d7e93570: am f11f9f47: Added a check if a custom activity can be started
automerge: 57641a8
* commit '57641a8b5080b5122fcdd98c56fffaef90b3992d':
Added a check if a custom activity can be started
diff --git a/src/com/android/settings/users/AppRestrictionsFragment.java b/src/com/android/settings/users/AppRestrictionsFragment.java
index f1022b9..fcaf18f 100644
--- a/src/com/android/settings/users/AppRestrictionsFragment.java
+++ b/src/com/android/settings/users/AppRestrictionsFragment.java
@@ -24,6 +24,7 @@
import android.content.Intent;
import android.content.IntentFilter;
import android.content.RestrictionEntry;
+import android.content.pm.ActivityInfo;
import android.content.pm.ApplicationInfo;
import android.content.pm.IPackageManager;
import android.content.pm.PackageInfo;
@@ -924,6 +925,7 @@
} else if (restrictionsIntent != null) {
preference.setRestrictions(restrictions);
if (invokeIfCustom && AppRestrictionsFragment.this.isResumed()) {
+ assertSafeToStartCustomActivity(restrictionsIntent);
int requestCode = generateCustomActivityRequestCode(
RestrictionsResultReceiver.this.preference);
AppRestrictionsFragment.this.startActivityForResult(
@@ -931,6 +933,25 @@
}
}
}
+
+ private void assertSafeToStartCustomActivity(Intent intent) {
+ // Activity can be started if it belongs to the same app
+ if (intent.getPackage() != null && intent.getPackage().equals(packageName)) {
+ return;
+ }
+ // Activity can be started if intent resolves to multiple activities
+ List<ResolveInfo> resolveInfos = AppRestrictionsFragment.this.mPackageManager
+ .queryIntentActivities(intent, 0 /* no flags */);
+ if (resolveInfos.size() != 1) {
+ return;
+ }
+ // Prevent potential privilege escalation
+ ActivityInfo activityInfo = resolveInfos.get(0).activityInfo;
+ if (!packageName.equals(activityInfo.packageName)) {
+ throw new SecurityException("Application " + packageName
+ + " is not allowed to start activity " + intent);
+ };
+ }
}
private void onRestrictionsReceived(AppRestrictionsPreference preference, String packageName,