Skip to content
This repository has been archived by the owner on Nov 1, 2020. It is now read-only.

Commit

Permalink
Make sure apps cannot forge package name on AssistStructure used for …
Browse files Browse the repository at this point in the history 
…Autofill.

Test: cts-tradefed run commandAndExit cts-dev -m CtsAutoFillServiceTestCases -t android.autofillservice.cts.VirtualContainerActivityTest#testAppCannotFakePackageName
Test: cts-tradefed run commandAndExit cts-dev -m CtsAutoFillServiceTestCases

Bug: 69981710

Change-Id: Id6036cddb51dd8dd0c9128b7212d573f630d693f
Merged-In: Id6036cddb51dd8dd0c9128b7212d573f630d693f
(cherry picked from commit 23e61a9)
  • Loading branch information
@the-felipeal
the-felipeal authored and android-build-team Robot committed Mar 21, 2018
1 parent 65ff524 commit ae2aada
Show file tree
Hide file tree
Showing 7 changed files with 115 additions and 26 deletions.
10 changes: 10 additions & 0 deletions core/java/android/app/assist/AssistStructure.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2058,6 +2058,16 @@ public ComponentName getActivityComponent() {
return mActivityComponent;
}

/**
* Called by Autofill server when app forged a different value.
*
* @hide
*/
public void setActivityComponent(ComponentName componentName) {
ensureData();
mActivityComponent = componentName;
}

/** @hide */
public int getFlags() {
return mFlags;
Expand Down
26 changes: 23 additions & 3 deletions core/java/android/view/autofill/AutofillManager.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@
import android.annotation.NonNull;
import android.annotation.Nullable;
import android.annotation.SystemService;
import android.app.Activity;
import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.content.IntentSender;
Expand All @@ -44,6 +46,7 @@
import com.android.internal.annotations.GuardedBy;
import com.android.internal.logging.MetricsLogger;
import com.android.internal.logging.nano.MetricsProto.MetricsEvent;
import com.android.internal.util.Preconditions;

import java.io.PrintWriter;
import java.lang.annotation.Retention;
Expand Down Expand Up @@ -390,7 +393,7 @@ boolean autofillCallbackRequestShowFillUi(@NonNull View anchor, int width, int h
* @hide
*/
public AutofillManager(Context context, IAutoFillManager service) {
mContext = context;
mContext = Preconditions.checkNotNull(context, "context cannot be null");
mService = service;
}

Expand Down Expand Up @@ -940,6 +943,13 @@ private AutofillClient getClientLocked() {
return mContext.getAutofillClient();
}

private ComponentName getComponentNameFromContext() {
if (mContext instanceof Activity) {
return ((Activity) mContext).getComponentName();
}
return null;
}

/** @hide */
public void onAuthenticationResult(int authenticationId, Intent data) {
if (!hasAutofillFeature()) {
Expand Down Expand Up @@ -990,9 +1000,14 @@ private void startSessionLocked(@NonNull AutofillId id, @NonNull Rect bounds,
return;
}
try {
final ComponentName componentName = getComponentNameFromContext();
if (componentName == null) {
Log.w(TAG, "startSessionLocked(): context is not activity: " + mContext);
return;
}
mSessionId = mService.startSession(mContext.getActivityToken(),
mServiceClient.asBinder(), id, bounds, value, mContext.getUserId(),
mCallback != null, flags, mContext.getOpPackageName());
mCallback != null, flags, componentName);
if (mSessionId != NO_SESSION) {
mState = STATE_ACTIVE;
}
Expand Down Expand Up @@ -1050,9 +1065,14 @@ private void updateSessionLocked(AutofillId id, Rect bounds, AutofillValue value

try {
if (restartIfNecessary) {
final ComponentName componentName = getComponentNameFromContext();
if (componentName == null) {
Log.w(TAG, "startSessionLocked(): context is not activity: " + mContext);
return;
}
final int newId = mService.updateOrRestartSession(mContext.getActivityToken(),
mServiceClient.asBinder(), id, bounds, value, mContext.getUserId(),
mCallback != null, flags, mContext.getOpPackageName(), mSessionId, action);
mCallback != null, flags, componentName, mSessionId, action);
if (newId != mSessionId) {
if (sDebug) Log.d(TAG, "Session restarted: " + mSessionId + "=>" + newId);
mSessionId = newId;
Expand Down
6 changes: 4 additions & 2 deletions core/java/android/view/autofill/IAutoFillManager.aidl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@

package android.view.autofill;

import android.content.ComponentName;
import android.graphics.Rect;
import android.os.Bundle;
import android.os.IBinder;
Expand All @@ -34,14 +35,15 @@ interface IAutoFillManager {
int addClient(in IAutoFillManagerClient client, int userId);
int startSession(IBinder activityToken, in IBinder appCallback, in AutofillId autoFillId,
in Rect bounds, in AutofillValue value, int userId, boolean hasCallback, int flags,
String packageName);
in ComponentName componentName);
FillEventHistory getFillEventHistory();
boolean restoreSession(int sessionId, in IBinder activityToken, in IBinder appCallback);
void updateSession(int sessionId, in AutofillId id, in Rect bounds,
in AutofillValue value, int action, int flags, int userId);
int updateOrRestartSession(IBinder activityToken, in IBinder appCallback,
in AutofillId autoFillId, in Rect bounds, in AutofillValue value, int userId,
boolean hasCallback, int flags, String packageName, int sessionId, int action);
boolean hasCallback, int flags, in ComponentName componentName, int sessionId,
int action);
void finishSession(int sessionId, int userId);
void cancelSession(int sessionId, int userId);
void setAuthenticationResult(in Bundle data, int sessionId, int authenticationId, int userId);
Expand Down
13 changes: 13 additions & 0 deletions proto/src/metrics_constants.proto
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4006,6 +4006,19 @@ message MetricsEvent {
// OS: O
FIELD_NOTIFICATION_GROUP_SUMMARY = 947;

// An app attempted to forge a different component name in the AssisStructure that would be
// passed to the autofill service.
// OS: O (security patch)
// Package: Real package of the app being autofilled
// Tag FIELD_AUTOFILL_SERVICE: Package of the autofill service that processed the request
// TAG FIELD_AUTOFILL_FORGED_COMPONENT_NAME: Component name being forged
AUTOFILL_FORGED_COMPONENT_ATTEMPT = 948;

// FIELD - The component that an app tried tro forged.
// Type: string
// OS: O (security patch)
FIELD_AUTOFILL_FORGED_COMPONENT_NAME = 949;

// ---- End O Constants, all O constants go above this line ----

// OPEN: Settings > System > Languages & input > Advanced > Lift to open camera
Expand Down
14 changes: 8 additions & 6 deletions services/autofill/java/com/android/server/autofill/AutofillManagerService.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -533,25 +533,26 @@ public void setHasCallback(int sessionId, int userId, boolean hasIt) {
@Override
public int startSession(IBinder activityToken, IBinder appCallback, AutofillId autofillId,
Rect bounds, AutofillValue value, int userId, boolean hasCallback, int flags,
String packageName) {
ComponentName componentName) {

activityToken = Preconditions.checkNotNull(activityToken, "activityToken");
appCallback = Preconditions.checkNotNull(appCallback, "appCallback");
autofillId = Preconditions.checkNotNull(autofillId, "autoFillId");
packageName = Preconditions.checkNotNull(packageName, "packageName");
componentName = Preconditions.checkNotNull(componentName, "componentName");
final String packageName = Preconditions.checkNotNull(componentName.getPackageName());

Preconditions.checkArgument(userId == UserHandle.getUserId(getCallingUid()), "userId");

try {
mContext.getPackageManager().getPackageInfoAsUser(packageName, 0, userId);
} catch (PackageManager.NameNotFoundException e) {
throw new IllegalArgumentException(packageName + " is not a valid package", e);
throw new IllegalArgumentException(componentName + " is not a valid package", e);
}

synchronized (mLock) {
final AutofillManagerServiceImpl service = getServiceForUserLocked(userId);
return service.startSessionLocked(activityToken, getCallingUid(), appCallback,
autofillId, bounds, value, hasCallback, flags, packageName);
autofillId, bounds, value, hasCallback, flags, componentName);
}
}

Expand Down Expand Up @@ -603,7 +604,8 @@ public void updateSession(int sessionId, AutofillId autoFillId, Rect bounds,
@Override
public int updateOrRestartSession(IBinder activityToken, IBinder appCallback,
AutofillId autoFillId, Rect bounds, AutofillValue value, int userId,
boolean hasCallback, int flags, String packageName, int sessionId, int action) {
boolean hasCallback, int flags, ComponentName componentName, int sessionId,
int action) {
boolean restart = false;
synchronized (mLock) {
final AutofillManagerServiceImpl service = peekServiceForUserLocked(userId);
Expand All @@ -614,7 +616,7 @@ public int updateOrRestartSession(IBinder activityToken, IBinder appCallback,
}
if (restart) {
return startSession(activityToken, appCallback, autoFillId, bounds, value, userId,
hasCallback, flags, packageName);
hasCallback, flags, componentName);
}

// Nothing changed...
Expand Down
40 changes: 36 additions & 4 deletions services/autofill/java/com/android/server/autofill/AutofillManagerServiceImpl.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
import android.content.Context;
import android.content.pm.ApplicationInfo;
import android.content.pm.PackageManager;
import android.content.pm.PackageManager.NameNotFoundException;
import android.content.pm.ServiceInfo;
import android.graphics.Rect;
import android.graphics.drawable.Drawable;
Expand All @@ -43,6 +44,7 @@
import android.os.Looper;
import android.os.RemoteCallbackList;
import android.os.RemoteException;
import android.os.UserHandle;
import android.os.UserManager;
import android.provider.Settings;
import android.service.autofill.AutofillService;
Expand Down Expand Up @@ -279,7 +281,7 @@ void setHasCallback(int sessionId, int uid, boolean hasIt) {
int startSessionLocked(@NonNull IBinder activityToken, int uid,
@NonNull IBinder appCallbackToken, @NonNull AutofillId autofillId,
@NonNull Rect virtualBounds, @Nullable AutofillValue value, boolean hasCallback,
int flags, @NonNull String packageName) {
int flags, @NonNull ComponentName componentName) {
if (!isEnabled()) {
return 0;
}
Expand All @@ -289,7 +291,7 @@ int startSessionLocked(@NonNull IBinder activityToken, int uid,
pruneAbandonedSessionsLocked();

final Session newSession = createSessionByTokenLocked(activityToken, uid, appCallbackToken,
hasCallback, packageName);
hasCallback, componentName);
if (newSession == null) {
return NO_SESSION;
}
Expand Down Expand Up @@ -386,7 +388,8 @@ void disableOwnedAutofillServicesLocked(int uid) {
}

private Session createSessionByTokenLocked(@NonNull IBinder activityToken, int uid,
@NonNull IBinder appCallbackToken, boolean hasCallback, @NonNull String packageName) {
@NonNull IBinder appCallbackToken, boolean hasCallback,
@NonNull ComponentName componentName) {
// use random ids so that one app cannot know that another app creates sessions
int sessionId;
int tries = 0;
Expand All @@ -400,14 +403,43 @@ private Session createSessionByTokenLocked(@NonNull IBinder activityToken, int u
sessionId = sRandom.nextInt();
} while (sessionId == NO_SESSION || mSessions.indexOfKey(sessionId) >= 0);

assertCallerLocked(componentName);

final Session newSession = new Session(this, mUi, mContext, mHandlerCaller, mUserId, mLock,
sessionId, uid, activityToken, appCallbackToken, hasCallback,
mUiLatencyHistory, mInfo.getServiceInfo().getComponentName(), packageName);
mUiLatencyHistory, mInfo.getServiceInfo().getComponentName(), componentName);
mSessions.put(newSession.id, newSession);

return newSession;
}

/**
* Asserts the component is owned by the caller.
*/
private void assertCallerLocked(@NonNull ComponentName componentName) {
final PackageManager pm = mContext.getPackageManager();
final int callingUid = Binder.getCallingUid();
final int packageUid;
try {
packageUid = pm.getPackageUidAsUser(componentName.getPackageName(),
UserHandle.getCallingUserId());
} catch (NameNotFoundException e) {
throw new SecurityException("Could not verify UID for " + componentName);
}
if (callingUid != packageUid) {
final String[] packages = pm.getPackagesForUid(callingUid);
final String callingPackage = packages != null ? packages[0] : "uid-" + callingUid;
Slog.w(TAG, "App (package=" + callingPackage + ", UID=" + callingUid
+ ") passed component (" + componentName + ") owned by UID " + packageUid);
mMetricsLogger.write(new LogMaker(MetricsEvent.AUTOFILL_FORGED_COMPONENT_ATTEMPT)
.setPackageName(callingPackage)
.addTaggedData(MetricsEvent.FIELD_AUTOFILL_SERVICE, getServicePackageName())
.addTaggedData(MetricsEvent.FIELD_AUTOFILL_FORGED_COMPONENT_NAME,
componentName == null ? "null" : componentName.flattenToShortString()));
throw new SecurityException("Invalid component: " + componentName);
}
}

/**
* Restores a session after an activity was temporarily destroyed.
*
Expand Down
32 changes: 21 additions & 11 deletions services/autofill/java/com/android/server/autofill/Session.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -126,8 +126,8 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
@GuardedBy("mLock")
@NonNull private IBinder mActivityToken;

/** Package name of the app that is auto-filled */
@NonNull private final String mPackageName;
/** Component that's being auto-filled */
@NonNull private final ComponentName mComponentName;

@GuardedBy("mLock")
private final ArrayMap<AutofillId, ViewState> mViewStates = new ArrayMap<>();
Expand Down Expand Up @@ -227,6 +227,16 @@ public void send(int resultCode, Bundle resultData) throws RemoteException {
structure.ensureData();

// Sanitize structure before it's sent to service.
final ComponentName componentNameFromApp = structure.getActivityComponent();
if (!mComponentName.equals(componentNameFromApp)) {
Slog.w(TAG, "Activity " + mComponentName + " forged different component on "
+ "AssistStructure: " + componentNameFromApp);
structure.setActivityComponent(mComponentName);
mMetricsLogger.write(newLogMaker(MetricsEvent.AUTOFILL_FORGED_COMPONENT_ATTEMPT)
.addTaggedData(MetricsEvent.FIELD_AUTOFILL_FORGED_COMPONENT_NAME,
componentNameFromApp == null ? "null"
: componentNameFromApp.flattenToShortString()));
}
structure.sanitizeForParceling(true);

// Flags used to start the session.
Expand Down Expand Up @@ -415,19 +425,19 @@ private void requestNewFillResponseLocked(int flags) {
@NonNull Context context, @NonNull HandlerCaller handlerCaller, int userId,
@NonNull Object lock, int sessionId, int uid, @NonNull IBinder activityToken,
@NonNull IBinder client, boolean hasCallback, @NonNull LocalLog uiLatencyHistory,
@NonNull ComponentName componentName, @NonNull String packageName) {
@NonNull ComponentName serviceComponentName, @NonNull ComponentName appComponentName) {
id = sessionId;
this.uid = uid;
mStartTime = SystemClock.elapsedRealtime();
mService = service;
mLock = lock;
mUi = ui;
mHandlerCaller = handlerCaller;
mRemoteFillService = new RemoteFillService(context, componentName, userId, this);
mRemoteFillService = new RemoteFillService(context, serviceComponentName, userId, this);
mActivityToken = activityToken;
mHasCallback = hasCallback;
mUiLatencyHistory = uiLatencyHistory;
mPackageName = packageName;
mComponentName = appComponentName;
mClient = IAutoFillManagerClient.Stub.asInterface(client);

writeLog(MetricsEvent.AUTOFILL_SESSION_STARTED);
Expand Down Expand Up @@ -1008,8 +1018,8 @@ public boolean showSaveLocked() {
final IAutoFillManagerClient client = getClient();
mPendingSaveUi = new PendingUi(mActivityToken, id, client);
getUiForShowing().showSaveUi(mService.getServiceLabel(), mService.getServiceIcon(),
mService.getServicePackageName(), saveInfo, valueFinder, mPackageName, this,
mPendingSaveUi);
mService.getServicePackageName(), saveInfo, valueFinder,
mComponentName.getPackageName(), this, mPendingSaveUi);
if (client != null) {
try {
client.setSaveUiState(id, true);
Expand Down Expand Up @@ -1365,7 +1375,7 @@ public void onFillReady(FillResponse response, AutofillId filledId,
}

getUiForShowing().showFillUi(filledId, response, filterText,
mService.getServicePackageName(), mPackageName, this);
mService.getServicePackageName(), mComponentName.getPackageName(), this);

synchronized (mLock) {
if (mUiShownTime == 0) {
Expand Down Expand Up @@ -1690,14 +1700,14 @@ private void startAuthentication(int authenticationId, IntentSender intent,

@Override
public String toString() {
return "Session: [id=" + id + ", pkg=" + mPackageName + "]";
return "Session: [id=" + id + ", pkg=" + mComponentName.getPackageName() + "]";
}

void dumpLocked(String prefix, PrintWriter pw) {
final String prefix2 = prefix + " ";
pw.print(prefix); pw.print("id: "); pw.println(id);
pw.print(prefix); pw.print("uid: "); pw.println(uid);
pw.print(prefix); pw.print("mPackagename: "); pw.println(mPackageName);
pw.print(prefix); pw.print("mComponentName: "); pw.println(mComponentName);
pw.print(prefix); pw.print("mActivityToken: "); pw.println(mActivityToken);
pw.print(prefix); pw.print("mStartTime: "); pw.println(mStartTime);
pw.print(prefix); pw.print("Time to show UI: ");
Expand Down Expand Up @@ -1920,7 +1930,7 @@ private LogMaker newLogMaker(int category) {
}

private LogMaker newLogMaker(int category, String servicePackageName) {
return Helper.newLogMaker(category, mPackageName, servicePackageName);
return Helper.newLogMaker(category, mComponentName.getPackageName(), servicePackageName);
}

private void writeLog(int category) {
Expand Down

0 comments on commit ae2aada

Please sign in to comment.