Fix bluetooth settings will broadcast to anywhere when some cases
BluetoothPermissionActivity and DevicePickerFragment will send
broadcast to return the result to calling apps. As this broadcast
intent is from Settings with uid 1000, it will be sent to any
protected BroadcastReceivers in the device. It can make an attacker
send broadcast to protected BroadcastReceivers like factory reset intent
(android/com.android.server.MasterClearReceiver) via
BluetoothPermissionActivity or DevicePickerFragment.
This CL will compare to calling package name with launch package name.
If they are not equal, the broadcast will not send to launch package name.
Bug: 179386960
Bug: 179386068
Test: make -j42 RunSettingsRoboTests and use test apk to manually test
to verify factory reset not started and no system UI notification.
Change-Id: Ib8a5acde663e875912d300dd4912c4e9416f02f1
diff --git a/src/com/android/settings/bluetooth/BluetoothPermissionActivity.java b/src/com/android/settings/bluetooth/BluetoothPermissionActivity.java
index e40e30d..cd36ce8 100644
--- a/src/com/android/settings/bluetooth/BluetoothPermissionActivity.java
+++ b/src/com/android/settings/bluetooth/BluetoothPermissionActivity.java
@@ -16,6 +16,8 @@
package com.android.settings.bluetooth;
+import static android.view.WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS;
+
import android.bluetooth.BluetoothDevice;
import android.content.BroadcastReceiver;
import android.content.Context;
@@ -23,6 +25,7 @@
import android.content.Intent;
import android.content.IntentFilter;
import android.os.Bundle;
+import android.text.TextUtils;
import android.util.Log;
import android.view.View;
import android.widget.Button;
@@ -30,11 +33,14 @@
import androidx.preference.Preference;
+import com.android.internal.annotations.VisibleForTesting;
import com.android.internal.app.AlertActivity;
import com.android.internal.app.AlertController;
import com.android.settings.R;
-
-import static android.view.WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS;
+import com.android.settings.password.PasswordUtils;
+import com.android.settingslib.bluetooth.CachedBluetoothDevice;
+import com.android.settingslib.bluetooth.CachedBluetoothDeviceManager;
+import com.android.settingslib.bluetooth.LocalBluetoothManager;
/**
* BluetoothPermissionActivity shows a dialog for accepting incoming
@@ -51,8 +57,13 @@
private TextView messageView;
private Button mOkButton;
private BluetoothDevice mDevice;
- private String mReturnPackage = null;
- private String mReturnClass = null;
+
+ @VisibleForTesting
+ String mReturnPackage = null;
+ @VisibleForTesting
+ String mReturnClass = null;
+ @VisibleForTesting
+ String mCallingAppPackageName;
private int mRequestType = 0;
private BroadcastReceiver mReceiver = new BroadcastReceiver() {
@@ -80,6 +91,7 @@
getWindow().addPrivateFlags(SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS);
Intent i = getIntent();
+ mCallingAppPackageName = PasswordUtils.getCallingAppPackageName(getActivityToken());
String action = i.getAction();
if (!action.equals(BluetoothDevice.ACTION_CONNECTION_ACCESS_REQUEST)) {
Log.e(TAG, "Error: this activity may be started only with intent "
@@ -94,6 +106,22 @@
mRequestType = i.getIntExtra(BluetoothDevice.EXTRA_ACCESS_REQUEST_TYPE,
BluetoothDevice.REQUEST_TYPE_PHONEBOOK_ACCESS);
+ // Even if the user has already made the choice, Bluetooth still may not know that if
+ // the user preference data have not been migrated from Settings app's shared
+ // preferences to Bluetooth app's. In that case, Bluetooth app broadcasts an
+ // ACTION_CONNECTION_ACCESS_REQUEST intent to ask to Settings app.
+ //
+ // If that happens, 'checkUserChoice()' here will do migration because it finds or
+ // creates a 'CachedBluetoothDevice' object for the device.
+ //
+ // After migration is done, 'checkUserChoice()' replies to the request by sending an
+ // ACTION_CONNECTION_ACCESS_REPLY intent. And we don't need to start permission activity
+ // dialog or notification.
+ if (checkUserChoice()) {
+ finish();
+ return;
+ }
+
if(DEBUG) Log.i(TAG, "onCreate() Request type: " + mRequestType);
if (mRequestType == BluetoothDevice.REQUEST_TYPE_PROFILE_CONNECTION) {
@@ -202,7 +230,14 @@
sendReplyIntentToReceiver(false, true);
}
- private void sendReplyIntentToReceiver(final boolean allowed, final boolean always) {
+ @VisibleForTesting
+ void sendReplyIntentToReceiver(final boolean allowed, final boolean always) {
+ if (!TextUtils.equals(mCallingAppPackageName, mReturnPackage)) {
+ Log.w(TAG, "sendReplyIntentToReceiver() return package name is not equivalent"
+ + " to calling package name!");
+ return;
+ }
+
Intent intent = new Intent(BluetoothDevice.ACTION_CONNECTION_ACCESS_REPLY);
if (mReturnPackage != null && mReturnClass != null) {
@@ -246,4 +281,76 @@
public boolean onPreferenceChange(Preference preference, Object newValue) {
return true;
}
+
+ /**
+ * @return true user had made a choice, this method replies to the request according
+ * to user's previous decision
+ * false user hadnot made any choice on this device
+ */
+ private boolean checkUserChoice() {
+ boolean processed = false;
+
+ // ignore if it is something else than phonebook/message settings it wants us to remember
+ if (mRequestType != BluetoothDevice.REQUEST_TYPE_PHONEBOOK_ACCESS
+ && mRequestType != BluetoothDevice.REQUEST_TYPE_MESSAGE_ACCESS
+ && mRequestType != BluetoothDevice.REQUEST_TYPE_SIM_ACCESS) {
+ Log.d(TAG, "checkUserChoice(): Unknown RequestType " + mRequestType);
+ return processed;
+ }
+
+ final LocalBluetoothManager bluetoothManager = Utils.getLocalBtManager(this);
+ final CachedBluetoothDeviceManager cachedDeviceManager =
+ bluetoothManager.getCachedDeviceManager();
+ CachedBluetoothDevice cachedDevice = cachedDeviceManager.findDevice(mDevice);
+ if (cachedDevice == null) {
+ cachedDevice = cachedDeviceManager.addDevice(mDevice);
+ }
+
+ if (mRequestType == BluetoothDevice.REQUEST_TYPE_PHONEBOOK_ACCESS) {
+ final int phonebookPermission = mDevice.getPhonebookAccessPermission();
+
+ if (phonebookPermission == BluetoothDevice.ACCESS_UNKNOWN) {
+ // Leave 'processed' as false.
+ } else if (phonebookPermission == BluetoothDevice.ACCESS_ALLOWED) {
+ sendReplyIntentToReceiver(true, true);
+ processed = true;
+ } else if (phonebookPermission == BluetoothDevice.ACCESS_REJECTED) {
+ sendReplyIntentToReceiver(false, true);
+ processed = true;
+ } else {
+ Log.e(TAG, "Bad phonebookPermission: " + phonebookPermission);
+ }
+ } else if (mRequestType == BluetoothDevice.REQUEST_TYPE_MESSAGE_ACCESS) {
+ final int messagePermission = mDevice.getMessageAccessPermission();
+
+ if (messagePermission == BluetoothDevice.ACCESS_UNKNOWN) {
+ // Leave 'processed' as false.
+ } else if (messagePermission == BluetoothDevice.ACCESS_ALLOWED) {
+ sendReplyIntentToReceiver(true, true);
+ processed = true;
+ } else if (messagePermission == BluetoothDevice.ACCESS_REJECTED) {
+ sendReplyIntentToReceiver(false, true);
+ processed = true;
+ } else {
+ Log.e(TAG, "Bad messagePermission: " + messagePermission);
+ }
+ } else if (mRequestType == BluetoothDevice.REQUEST_TYPE_SIM_ACCESS) {
+ final int simPermission = mDevice.getSimAccessPermission();
+
+ if (simPermission == BluetoothDevice.ACCESS_UNKNOWN) {
+ // Leave 'processed' as false.
+ } else if (simPermission == BluetoothDevice.ACCESS_ALLOWED) {
+ sendReplyIntentToReceiver(true, true);
+ processed = true;
+ } else if (simPermission == BluetoothDevice.ACCESS_REJECTED) {
+ sendReplyIntentToReceiver(false, true);
+ processed = true;
+ } else {
+ Log.e(TAG, "Bad simPermission: " + simPermission);
+ }
+ }
+
+ Log.d(TAG, "checkUserChoice(): returning " + processed);
+ return processed;
+ }
}
diff --git a/src/com/android/settings/bluetooth/BluetoothPermissionRequest.java b/src/com/android/settings/bluetooth/BluetoothPermissionRequest.java
index 7fac4991c..c606e31 100644
--- a/src/com/android/settings/bluetooth/BluetoothPermissionRequest.java
+++ b/src/com/android/settings/bluetooth/BluetoothPermissionRequest.java
@@ -29,9 +29,6 @@
import android.util.Log;
import com.android.settings.R;
-import com.android.settingslib.bluetooth.CachedBluetoothDevice;
-import com.android.settingslib.bluetooth.CachedBluetoothDeviceManager;
-import com.android.settingslib.bluetooth.LocalBluetoothManager;
/**
* BluetoothPermissionRequest is a receiver to receive Bluetooth connection
@@ -83,21 +80,6 @@
if (DEBUG) Log.d(TAG, "onReceive request type: " + mRequestType + " return "
+ mReturnPackage + "," + mReturnClass);
- // Even if the user has already made the choice, Bluetooth still may not know that if
- // the user preference data have not been migrated from Settings app's shared
- // preferences to Bluetooth app's. In that case, Bluetooth app broadcasts an
- // ACTION_CONNECTION_ACCESS_REQUEST intent to ask to Settings app.
- //
- // If that happens, 'checkUserChoice()' here will do migration because it finds or
- // creates a 'CachedBluetoothDevice' object for the device.
- //
- // After migration is done, 'checkUserChoice()' replies to the request by sending an
- // ACTION_CONNECTION_ACCESS_REPLY intent. And we don't need to start permission activity
- // dialog or notification.
- if (checkUserChoice()) {
- return;
- }
-
Intent connectionAccessIntent = new Intent(action);
connectionAccessIntent.setClass(context, BluetoothPermissionActivity.class);
// We use the FLAG_ACTIVITY_MULTIPLE_TASK since we can have multiple concurrent access
@@ -212,92 +194,4 @@
}
return null;
}
-
- /**
- * @return true user had made a choice, this method replies to the request according
- * to user's previous decision
- * false user hadnot made any choice on this device
- */
- private boolean checkUserChoice() {
- boolean processed = false;
-
- // ignore if it is something else than phonebook/message settings it wants us to remember
- if (mRequestType != BluetoothDevice.REQUEST_TYPE_PHONEBOOK_ACCESS
- && mRequestType != BluetoothDevice.REQUEST_TYPE_MESSAGE_ACCESS
- && mRequestType != BluetoothDevice.REQUEST_TYPE_SIM_ACCESS) {
- if (DEBUG) Log.d(TAG, "checkUserChoice(): Unknown RequestType " + mRequestType);
- return processed;
- }
-
- LocalBluetoothManager bluetoothManager = Utils.getLocalBtManager(mContext);
- CachedBluetoothDeviceManager cachedDeviceManager =
- bluetoothManager.getCachedDeviceManager();
- CachedBluetoothDevice cachedDevice = cachedDeviceManager.findDevice(mDevice);
- if (cachedDevice == null) {
- cachedDevice = cachedDeviceManager.addDevice(mDevice);
- }
-
- String intentName = BluetoothDevice.ACTION_CONNECTION_ACCESS_REPLY;
-
- if (mRequestType == BluetoothDevice.REQUEST_TYPE_PHONEBOOK_ACCESS) {
- int phonebookPermission = mDevice.getPhonebookAccessPermission();
-
- if (phonebookPermission == BluetoothDevice.ACCESS_UNKNOWN) {
- // Leave 'processed' as false.
- } else if (phonebookPermission == BluetoothDevice.ACCESS_ALLOWED) {
- sendReplyIntentToReceiver(true);
- processed = true;
- } else if (phonebookPermission == BluetoothDevice.ACCESS_REJECTED) {
- sendReplyIntentToReceiver(false);
- processed = true;
- } else {
- Log.e(TAG, "Bad phonebookPermission: " + phonebookPermission);
- }
- } else if (mRequestType == BluetoothDevice.REQUEST_TYPE_MESSAGE_ACCESS) {
- int messagePermission = mDevice.getMessageAccessPermission();
-
- if (messagePermission == BluetoothDevice.ACCESS_UNKNOWN) {
- // Leave 'processed' as false.
- } else if (messagePermission == BluetoothDevice.ACCESS_ALLOWED) {
- sendReplyIntentToReceiver(true);
- processed = true;
- } else if (messagePermission == BluetoothDevice.ACCESS_REJECTED) {
- sendReplyIntentToReceiver(false);
- processed = true;
- } else {
- Log.e(TAG, "Bad messagePermission: " + messagePermission);
- }
- } else if(mRequestType == BluetoothDevice.REQUEST_TYPE_SIM_ACCESS) {
- int simPermission = mDevice.getSimAccessPermission();
-
- if (simPermission == BluetoothDevice.ACCESS_UNKNOWN) {
- // Leave 'processed' as false.
- } else if (simPermission == BluetoothDevice.ACCESS_ALLOWED) {
- sendReplyIntentToReceiver(true);
- processed = true;
- } else if (simPermission == BluetoothDevice.ACCESS_REJECTED) {
- sendReplyIntentToReceiver(false);
- processed = true;
- } else {
- Log.e(TAG, "Bad simPermission: " + simPermission);
- }
- }
- if (DEBUG) Log.d(TAG,"checkUserChoice(): returning " + processed);
- return processed;
- }
-
- private void sendReplyIntentToReceiver(final boolean allowed) {
- Intent intent = new Intent(BluetoothDevice.ACTION_CONNECTION_ACCESS_REPLY);
-
- if (mReturnPackage != null && mReturnClass != null) {
- intent.setClassName(mReturnPackage, mReturnClass);
- }
-
- intent.putExtra(BluetoothDevice.EXTRA_CONNECTION_ACCESS_RESULT,
- allowed ? BluetoothDevice.CONNECTION_ACCESS_YES
- : BluetoothDevice.CONNECTION_ACCESS_NO);
- intent.putExtra(BluetoothDevice.EXTRA_DEVICE, mDevice);
- intent.putExtra(BluetoothDevice.EXTRA_ACCESS_REQUEST_TYPE, mRequestType);
- mContext.sendBroadcast(intent, android.Manifest.permission.BLUETOOTH_ADMIN);
- }
}
diff --git a/src/com/android/settings/bluetooth/DevicePickerFragment.java b/src/com/android/settings/bluetooth/DevicePickerFragment.java
index ab8eea5..214c590 100644
--- a/src/com/android/settings/bluetooth/DevicePickerFragment.java
+++ b/src/com/android/settings/bluetooth/DevicePickerFragment.java
@@ -27,12 +27,15 @@
import android.content.Intent;
import android.os.Bundle;
import android.os.UserManager;
+import android.text.TextUtils;
+import android.util.Log;
import android.view.Menu;
import android.view.MenuInflater;
import androidx.annotation.VisibleForTesting;
import com.android.settings.R;
+import com.android.settings.password.PasswordUtils;
import com.android.settingslib.bluetooth.CachedBluetoothDevice;
import com.android.settingslib.core.AbstractPreferenceController;
@@ -48,10 +51,16 @@
@VisibleForTesting
BluetoothProgressCategory mAvailableDevicesCategory;
+ @VisibleForTesting
+ String mLaunchPackage;
+ @VisibleForTesting
+ String mLaunchClass;
+ @VisibleForTesting
+ String mCallingAppPackageName;
+ @VisibleForTesting
+ Context mContext;
private boolean mNeedAuth;
- private String mLaunchPackage;
- private String mLaunchClass;
private boolean mScanAllowed;
public DevicePickerFragment() {
@@ -85,6 +94,9 @@
getActivity().setTitle(getString(R.string.device_picker));
UserManager um = (UserManager) getSystemService(Context.USER_SERVICE);
mScanAllowed = !um.hasUserRestriction(DISALLOW_CONFIG_BLUETOOTH);
+ mCallingAppPackageName = PasswordUtils.getCallingAppPackageName(
+ getActivity().getActivityToken());
+ mContext = getContext();
setHasOptionsMenu(true);
}
@@ -188,11 +200,17 @@
}
private void sendDevicePickedIntent(BluetoothDevice device) {
+ if (!TextUtils.equals(mCallingAppPackageName, mLaunchPackage)) {
+ Log.w(TAG, "sendDevicePickedIntent() launch package name is not equivalent to"
+ + " calling package name!");
+ return;
+ }
+
Intent intent = new Intent(BluetoothDevicePicker.ACTION_DEVICE_SELECTED);
intent.putExtra(BluetoothDevice.EXTRA_DEVICE, device);
if (mLaunchPackage != null && mLaunchClass != null) {
intent.setClassName(mLaunchPackage, mLaunchClass);
}
- getActivity().sendBroadcast(intent, Manifest.permission.BLUETOOTH_ADMIN);
+ mContext.sendBroadcast(intent, Manifest.permission.BLUETOOTH_ADMIN);
}
}
diff --git a/tests/robotests/src/com/android/settings/bluetooth/BluetoothPermissionActivityTest.java b/tests/robotests/src/com/android/settings/bluetooth/BluetoothPermissionActivityTest.java
new file mode 100644
index 0000000..4dd568b
--- /dev/null
+++ b/tests/robotests/src/com/android/settings/bluetooth/BluetoothPermissionActivityTest.java
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.settings.bluetooth;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+
+import android.content.Context;
+import android.content.Intent;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.MockitoAnnotations;
+import org.robolectric.RobolectricTestRunner;
+import org.robolectric.RuntimeEnvironment;
+import org.robolectric.util.ReflectionHelpers;
+
+@RunWith(RobolectricTestRunner.class)
+public class BluetoothPermissionActivityTest {
+
+ private BluetoothPermissionActivity mActivity;
+ private Context mContext;
+
+ @Before
+ public void setUp() {
+ MockitoAnnotations.initMocks(this);
+ mContext = spy(RuntimeEnvironment.application);
+ mActivity = new BluetoothPermissionActivity();
+ }
+
+ @Test
+ public void callingPackageIsEqualToReturnPackage_sendBroadcastToReturnPackage() {
+ mActivity.mReturnPackage = "com.android.settings";
+ mActivity.mReturnClass = "com.android.settings.bluetooth.BluetoothPermissionActivity";
+ mActivity.mCallingAppPackageName = "com.android.settings";
+ final ArgumentCaptor<Intent> intentCaptor = ArgumentCaptor.forClass(Intent.class);
+ ReflectionHelpers.setField(mActivity, "mBase", mContext);
+
+ mActivity.sendReplyIntentToReceiver(true, true);
+
+ verify(mContext).sendBroadcast(intentCaptor.capture(),
+ eq("android.permission.BLUETOOTH_ADMIN"));
+ assertThat(intentCaptor.getValue().getComponent().getPackageName())
+ .isEqualTo("com.android.settings");
+ }
+
+ @Test
+ public void callingPackageIsNotEqualToReturnPackage_broadcastNotSend() {
+ mActivity.mReturnPackage = "com.fake.settings";
+ mActivity.mReturnClass = "com.android.settings.bluetooth.BluetoothPermissionActivity";
+ mActivity.mCallingAppPackageName = "com.android.settings";
+ final ArgumentCaptor<Intent> intentCaptor = ArgumentCaptor.forClass(Intent.class);
+ ReflectionHelpers.setField(mActivity, "mBase", mContext);
+
+ mActivity.sendReplyIntentToReceiver(true, true);
+
+ verify(mContext, never()).sendBroadcast(intentCaptor.capture(),
+ eq("android.permission.BLUETOOTH_ADMIN"));
+ }
+}
diff --git a/tests/robotests/src/com/android/settings/bluetooth/DevicePickerFragmentTest.java b/tests/robotests/src/com/android/settings/bluetooth/DevicePickerFragmentTest.java
index feaf683..f5635a9 100644
--- a/tests/robotests/src/com/android/settings/bluetooth/DevicePickerFragmentTest.java
+++ b/tests/robotests/src/com/android/settings/bluetooth/DevicePickerFragmentTest.java
@@ -16,28 +16,46 @@
package com.android.settings.bluetooth;
+import static com.google.common.truth.Truth.assertThat;
+
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.spy;
import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.bluetooth.BluetoothDevice;
+import android.content.Context;
+import android.content.Intent;
+
+import com.android.settingslib.bluetooth.CachedBluetoothDevice;
import org.junit.Before;
import org.junit.Test;
import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
import org.mockito.Mock;
import org.mockito.MockitoAnnotations;
import org.robolectric.RobolectricTestRunner;
+import org.robolectric.RuntimeEnvironment;
@RunWith(RobolectricTestRunner.class)
public class DevicePickerFragmentTest {
@Mock
private BluetoothProgressCategory mAvailableDevicesCategory;
+
private DevicePickerFragment mFragment;
+ private Context mContext;
@Before
public void setUp() {
MockitoAnnotations.initMocks(this);
mFragment = new DevicePickerFragment();
-
+ mContext = spy(RuntimeEnvironment.application);
+ mFragment.mContext = mContext;
mFragment.mAvailableDevicesCategory = mAvailableDevicesCategory;
}
@@ -49,4 +67,40 @@
verify(mAvailableDevicesCategory).setProgress(true);
}
+
+ @Test
+ public void callingPackageIsEqualToLaunchPackage_sendBroadcastToLaunchPackage() {
+ final CachedBluetoothDevice cachedDevice = mock(CachedBluetoothDevice.class);
+ final BluetoothDevice bluetoothDevice = mock(BluetoothDevice.class);
+ final ArgumentCaptor<Intent> intentCaptor = ArgumentCaptor.forClass(Intent.class);
+ when(cachedDevice.getDevice()).thenReturn(bluetoothDevice);
+ mFragment.mSelectedDevice = bluetoothDevice;
+ mFragment.mLaunchPackage = "com.android.settings";
+ mFragment.mLaunchClass = "com.android.settings.bluetooth.BluetoothPermissionActivity";
+ mFragment.mCallingAppPackageName = "com.android.settings";
+
+ mFragment.onDeviceBondStateChanged(cachedDevice, BluetoothDevice.BOND_BONDED);
+
+ verify(mContext).sendBroadcast(intentCaptor.capture(),
+ eq("android.permission.BLUETOOTH_ADMIN"));
+ assertThat(intentCaptor.getValue().getComponent().getPackageName())
+ .isEqualTo(mFragment.mLaunchPackage);
+ }
+
+ @Test
+ public void callingPackageIsNotEqualToLaunchPackage_broadcastNotSend() {
+ final CachedBluetoothDevice cachedDevice = mock(CachedBluetoothDevice.class);
+ final BluetoothDevice bluetoothDevice = mock(BluetoothDevice.class);
+ final ArgumentCaptor<Intent> intentCaptor = ArgumentCaptor.forClass(Intent.class);
+ when(cachedDevice.getDevice()).thenReturn(bluetoothDevice);
+ mFragment.mSelectedDevice = bluetoothDevice;
+ mFragment.mLaunchPackage = "com.fake.settings";
+ mFragment.mLaunchClass = "com.android.settings.bluetooth.BluetoothPermissionActivity";
+ mFragment.mCallingAppPackageName = "com.android.settings";
+
+ mFragment.onDeviceBondStateChanged(cachedDevice, BluetoothDevice.BOND_BONDED);
+
+ verify(mContext, never()).sendBroadcast(intentCaptor.capture(),
+ eq("android.permission.BLUETOOTH_ADMIN"));
+ }
}