commit da46dd4e8eac69daf935f94de38b969b89db3014
author Grace Jia <xiaotonj@google.com> Mon Aug 17 19:01:26 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Mon Aug 17 19:01:26 2020 +0000
tree d4db0749cc693516255c04dbbc9a52524a65c6de
parent 0103521b8a179f8c99e03062bff963d2d2356a75
parent 8a0643b572571e3acbeb029c426ee8af851b4464

Fix security vulnerability of TelecomManager#getPhoneAccountsForPackage am: f3f2d7c2dc am: 21bc22a06e am: 0b9f87a4e3 am: 094c156982 am: 1aadaf8e1a am: a6a9176d19 am: 8a0643b572

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/services/Telecomm/+/12141784

Change-Id: I34e77cffdb3db280f8c9e3254d6edc24e31ce4ee

src/com/android/server/telecom/TelecomServiceImpl.java

diff --git a/src/com/android/server/telecom/TelecomServiceImpl.java b/src/com/android/server/telecom/TelecomServiceImpl.java
index 62e0f3f..9ccae9a 100644
--- a/src/com/android/server/telecom/TelecomServiceImpl.java
+++ b/src/com/android/server/telecom/TelecomServiceImpl.java
@@ -279,6 +279,23 @@
 
         @Override
         public List<PhoneAccountHandle> getPhoneAccountsForPackage(String packageName) {
+            //TODO: Deprecate this in S
+            try {
+                enforceCallingPackage(packageName);
+            } catch (SecurityException se1) {
+                EventLog.writeEvent(0x534e4554, "153995334", Binder.getCallingUid(),
+                        "getPhoneAccountsForPackage: invalid calling package");
+                throw se1;
+            }
+
+            try {
+                enforcePermission(READ_PRIVILEGED_PHONE_STATE);
+            } catch (SecurityException se2) {
+                EventLog.writeEvent(0x534e4554, "153995334", Binder.getCallingUid(),
+                        "getPhoneAccountsForPackage: no permission");
+                throw se2;
+            }
+
             synchronized (mLock) {
                 final UserHandle callingUserHandle = Binder.getCallingUserHandle();
                 long token = Binder.clearCallingIdentity();