Merge "LatinIME: Fix Implicit PendingIntent Vulnerability" into main am: 1b3568f9c2
Original change: https://android-review.googlesource.com/c/platform/packages/inputmethods/LatinIME/+/3019664
Change-Id: I47f2c0609e86e24675da39477e995709cc34a3f9
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/java/src/com/android/inputmethod/dictionarypack/DictionaryService.java b/java/src/com/android/inputmethod/dictionarypack/DictionaryService.java
index fe988ac..5ab55bc 100644
--- a/java/src/com/android/inputmethod/dictionarypack/DictionaryService.java
+++ b/java/src/com/android/inputmethod/dictionarypack/DictionaryService.java
@@ -229,8 +229,14 @@
final long now = System.currentTimeMillis();
final long alarmTime = now + new Random().nextInt(MAX_ALARM_DELAY_MILLIS);
final Intent updateIntent = new Intent(DictionaryPackConstants.UPDATE_NOW_INTENT_ACTION);
+ // Set the package name to ensure the PendingIntent is only delivered to trusted components
+ updateIntent.setPackage(context.getPackageName());
+ int pendingIntentFlags = PendingIntent.FLAG_CANCEL_CURRENT;
+ if (android.os.Build.VERSION.SDK_INT >= 23) {
+ pendingIntentFlags |= PendingIntent.FLAG_IMMUTABLE;
+ }
final PendingIntent pendingIntent = PendingIntent.getBroadcast(context, 0,
- updateIntent, PendingIntent.FLAG_CANCEL_CURRENT);
+ updateIntent, pendingIntentFlags);
// We set the alarm in the type that doesn't forcefully wake the device
// from sleep, but fires the next time the device actually wakes for any