Skip to content

Commit 035ae46

Browse files
Android Build Coastguard Workerjwdunlap
Android Build Coastguard Worker
authored and
jwdunlap
committed
Merge cherrypicks of ['googleplex-android-review.googlesource.com/21027430', 'googleplex-android-review.googlesource.com/23502366', 'googleplex-android-review.googlesource.com/23877018', 'googleplex-android-review.googlesource.com/23785419', 'googleplex-android-review.googlesource.com/23818219', 'googleplex-android-review.googlesource.com/23835332', 'googleplex-android-review.googlesource.com/23436487', 'googleplex-android-review.googlesource.com/24057913', 'googleplex-android-review.googlesource.com/23982566', 'googleplex-android-review.googlesource.com/24301063', 'googleplex-android-review.googlesource.com/24359722'] into security-aosp-tm-release.
Change-Id: I7bb82f716f1748eabeb461fc4d8a7c9d48231ea6
2 parents 3e09cce + b72b66a commit 035ae46

File tree

111 files changed

+552
-76
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

111 files changed

+552
-76
lines changed

‎core/java/android/app/Notification.java‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2857,6 +2857,18 @@ public void visitUris(@NonNull Consumer<Uri> visitor) {
28572857
if (person != null) {
28582858
visitor.accept(person.getIconUri());
28592859
}
2860+
2861+
final RemoteInputHistoryItem[] history = extras.getParcelableArray(
2862+
Notification.EXTRA_REMOTE_INPUT_HISTORY_ITEMS,
2863+
RemoteInputHistoryItem.class);
2864+
if (history != null) {
2865+
for (int i = 0; i < history.length; i++) {
2866+
RemoteInputHistoryItem item = history[i];
2867+
if (item.getUri() != null) {
2868+
visitor.accept(item.getUri());
2869+
}
2870+
}
2871+
}
28602872
}
28612873

28622874
if (isStyle(MessagingStyle.class) && extras != null) {

‎core/java/android/database/DatabaseUtils.java‎

Lines changed: 23 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -511,17 +511,31 @@ public static void cursorFillWindow(final Cursor cursor,
511511
*/
512512
public static void appendEscapedSQLString(StringBuilder sb, String sqlString) {
513513
sb.append('\'');
514-
if (sqlString.indexOf('\'') != -1) {
515-
int length = sqlString.length();
516-
for (int i = 0; i < length; i++) {
517-
char c = sqlString.charAt(i);
518-
if (c == '\'') {
519-
sb.append('\'');
514+
int length = sqlString.length();
515+
for (int i = 0; i < length; i++) {
516+
char c = sqlString.charAt(i);
517+
if (Character.isHighSurrogate(c)) {
518+
if (i == length - 1) {
519+
continue;
520+
}
521+
if (Character.isLowSurrogate(sqlString.charAt(i + 1))) {
522+
// add them both
523+
sb.append(c);
524+
sb.append(sqlString.charAt(i + 1));
525+
continue;
526+
} else {
527+
// this is a lone surrogate, skip it
528+
continue;
520529
}
521-
sb.append(c);
522530
}
523-
} else
524-
sb.append(sqlString);
531+
if (Character.isLowSurrogate(c)) {
532+
continue;
533+
}
534+
if (c == '\'') {
535+
sb.append('\'');
536+
}
537+
sb.append(c);
538+
}
525539
sb.append('\'');
526540
}
527541

‎core/jni/android_view_InputDevice.cpp‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,15 +42,22 @@ jobject android_view_InputDevice_create(JNIEnv* env, const InputDeviceInfo& devi
4242
return NULL;
4343
}
4444

45+
// b/274058082: Pass a copy of the key character map to avoid concurrent
46+
// access
47+
std::shared_ptr<KeyCharacterMap> map = deviceInfo.getKeyCharacterMap();
48+
if (map != nullptr) {
49+
map = std::make_shared<KeyCharacterMap>(*map);
50+
}
51+
4552
ScopedLocalRef<jstring> descriptorObj(env,
4653
env->NewStringUTF(deviceInfo.getIdentifier().descriptor.c_str()));
4754
if (!descriptorObj.get()) {
4855
return NULL;
4956
}
5057

5158
ScopedLocalRef<jobject> kcmObj(env,
52-
android_view_KeyCharacterMap_create(env, deviceInfo.getId(),
53-
deviceInfo.getKeyCharacterMap()));
59+
android_view_KeyCharacterMap_create(env, deviceInfo.getId(),
60+
map));
5461
if (!kcmObj.get()) {
5562
return NULL;
5663
}

‎libs/WindowManager/Shell/src/com/android/wm/shell/pip/phone/PipMenuView.java‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@
4545
import android.graphics.Color;
4646
import android.graphics.Rect;
4747
import android.graphics.drawable.Drawable;
48+
import android.graphics.drawable.Icon;
4849
import android.net.Uri;
4950
import android.os.Bundle;
5051
import android.os.Handler;
@@ -509,13 +510,19 @@ private void updateActionViews(int menuState, Rect stackBounds) {
509510
final boolean isCloseAction = mCloseAction != null && Objects.equals(
510511
mCloseAction.getActionIntent(), action.getActionIntent());
511512

512-
// TODO: Check if the action drawable has changed before we reload it
513-
action.getIcon().loadDrawableAsync(mContext, d -> {
514-
if (d != null) {
515-
d.setTint(Color.WHITE);
516-
actionView.setImageDrawable(d);
517-
}
518-
}, mMainHandler);
513+
final int iconType = action.getIcon().getType();
514+
if (iconType == Icon.TYPE_URI || iconType == Icon.TYPE_URI_ADAPTIVE_BITMAP) {
515+
// Disallow loading icon from content URI
516+
actionView.setImageDrawable(null);
517+
} else {
518+
// TODO: Check if the action drawable has changed before we reload it
519+
action.getIcon().loadDrawableAsync(mContext, d -> {
520+
if (d != null) {
521+
d.setTint(Color.WHITE);
522+
actionView.setImageDrawable(d);
523+
}
524+
}, mMainHandler);
525+
}
519526
actionView.setCustomCloseBackgroundVisibility(
520527
isCloseAction ? View.VISIBLE : View.GONE);
521528
actionView.setContentDescription(action.getContentDescription());

‎media/java/android/media/RingtoneManager.java‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -776,10 +776,10 @@ public static Uri getActualDefaultRingtoneUri(Context context, int type) {
776776

777777
return ringtoneUri;
778778
}
779-
779+
780780
/**
781781
* Sets the {@link Uri} of the default sound for a given sound type.
782-
*
782+
*
783783
* @param context A context used for querying.
784784
* @param type The type whose default sound should be set. One of
785785
* {@link #TYPE_RINGTONE}, {@link #TYPE_NOTIFICATION}, or
@@ -795,6 +795,21 @@ public static void setActualDefaultRingtoneUri(Context context, int type, Uri ri
795795
if(!isInternalRingtoneUri(ringtoneUri)) {
796796
ringtoneUri = ContentProvider.maybeAddUserId(ringtoneUri, context.getUserId());
797797
}
798+
799+
if (ringtoneUri != null) {
800+
final String mimeType = resolver.getType(ringtoneUri);
801+
if (mimeType == null) {
802+
Log.e(TAG, "setActualDefaultRingtoneUri for URI:" + ringtoneUri
803+
+ " ignored: failure to find mimeType (no access from this context?)");
804+
return;
805+
}
806+
if (!(mimeType.startsWith("audio/") || mimeType.equals("application/ogg"))) {
807+
Log.e(TAG, "setActualDefaultRingtoneUri for URI:" + ringtoneUri
808+
+ " ignored: associated mimeType:" + mimeType + " is not an audio type");
809+
return;
810+
}
811+
}
812+
798813
Settings.System.putStringForUser(resolver, setting,
799814
ringtoneUri != null ? ringtoneUri.toString() : null, context.getUserId());
800815

‎packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3101,6 +3101,15 @@ public Setting getSettingLocked(int type, int userId, String name) {
31013101
return settingsState.getSettingLocked(name);
31023102
}
31033103

3104+
private boolean shouldExcludeSettingFromReset(Setting setting, String prefix) {
3105+
// If a prefix was specified, exclude settings whose names don't start with it.
3106+
if (prefix != null && !setting.getName().startsWith(prefix)) {
3107+
return true;
3108+
}
3109+
// Never reset SECURE_FRP_MODE, as it could be abused to bypass FRP via RescueParty.
3110+
return Secure.SECURE_FRP_MODE.equals(setting.getName());
3111+
}
3112+
31043113
public void resetSettingsLocked(int type, int userId, String packageName, int mode,
31053114
String tag) {
31063115
resetSettingsLocked(type, userId, packageName, mode, tag, /*prefix=*/
@@ -3123,7 +3132,7 @@ public void resetSettingsLocked(int type, int userId, String packageName, int mo
31233132
Setting setting = settingsState.getSettingLocked(name);
31243133
if (packageName.equals(setting.getPackageName())) {
31253134
if ((tag != null && !tag.equals(setting.getTag()))
3126-
|| (prefix != null && !setting.getName().startsWith(prefix))) {
3135+
|| shouldExcludeSettingFromReset(setting, prefix)) {
31273136
continue;
31283137
}
31293138
if (settingsState.resetSettingLocked(name)) {
@@ -3143,7 +3152,7 @@ public void resetSettingsLocked(int type, int userId, String packageName, int mo
31433152
Setting setting = settingsState.getSettingLocked(name);
31443153
if (!SettingsState.isSystemPackage(getContext(),
31453154
setting.getPackageName())) {
3146-
if (prefix != null && !setting.getName().startsWith(prefix)) {
3155+
if (shouldExcludeSettingFromReset(setting, prefix)) {
31473156
continue;
31483157
}
31493158
if (settingsState.resetSettingLocked(name)) {
@@ -3163,7 +3172,7 @@ public void resetSettingsLocked(int type, int userId, String packageName, int mo
31633172
Setting setting = settingsState.getSettingLocked(name);
31643173
if (!SettingsState.isSystemPackage(getContext(),
31653174
setting.getPackageName())) {
3166-
if (prefix != null && !setting.getName().startsWith(prefix)) {
3175+
if (shouldExcludeSettingFromReset(setting, prefix)) {
31673176
continue;
31683177
}
31693178
if (setting.isDefaultFromSystem()) {
@@ -3186,7 +3195,7 @@ public void resetSettingsLocked(int type, int userId, String packageName, int mo
31863195
for (String name : settingsState.getSettingNamesLocked()) {
31873196
Setting setting = settingsState.getSettingLocked(name);
31883197
boolean someSettingChanged = false;
3189-
if (prefix != null && !setting.getName().startsWith(prefix)) {
3198+
if (shouldExcludeSettingFromReset(setting, prefix)) {
31903199
continue;
31913200
}
31923201
if (setting.isDefaultFromSystem()) {

‎packages/SettingsProvider/test/src/com/android/providers/settings/SettingsProviderTest.java‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -464,6 +464,31 @@ private void testResetModeTrustedDefaultsCommon(int type) throws Exception {
464464
}
465465
}
466466

467+
// To prevent FRP bypasses, the SECURE_FRP_MODE setting should not be reset when all other
468+
// settings are reset. But it should still be possible to explicitly set its value.
469+
@Test
470+
public void testSecureFrpModeSettingCannotBeReset() throws Exception {
471+
final String name = Settings.Secure.SECURE_FRP_MODE;
472+
final String origValue = getSetting(SETTING_TYPE_GLOBAL, name);
473+
setSettingViaShell(SETTING_TYPE_GLOBAL, name, "1", false);
474+
try {
475+
assertEquals("1", getSetting(SETTING_TYPE_GLOBAL, name));
476+
for (int type : new int[] { SETTING_TYPE_GLOBAL, SETTING_TYPE_SECURE }) {
477+
resetSettingsViaShell(type, Settings.RESET_MODE_UNTRUSTED_DEFAULTS);
478+
resetSettingsViaShell(type, Settings.RESET_MODE_UNTRUSTED_CHANGES);
479+
resetSettingsViaShell(type, Settings.RESET_MODE_TRUSTED_DEFAULTS);
480+
}
481+
// The value should still be "1". It should not have been reset to null.
482+
assertEquals("1", getSetting(SETTING_TYPE_GLOBAL, name));
483+
// It should still be possible to explicitly set the value to "0".
484+
setSettingViaShell(SETTING_TYPE_GLOBAL, name, "0", false);
485+
assertEquals("0", getSetting(SETTING_TYPE_GLOBAL, name));
486+
} finally {
487+
setSettingViaShell(SETTING_TYPE_GLOBAL, name, origValue, false);
488+
assertEquals(origValue, getSetting(SETTING_TYPE_GLOBAL, name));
489+
}
490+
}
491+
467492
private void doTestQueryStringInBracketsViaProviderApiForType(int type) {
468493
// Make sure we have a clean slate.
469494
deleteStringViaProviderApi(type, FAKE_SETTING_NAME);

‎packages/SystemUI/res/values-af/strings.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -825,6 +825,7 @@
825825
<string name="media_move_closer_to_end_cast" msgid="6495907340926563656">"Beweeg nader aan <xliff:g id="DEVICENAME">%1$s</xliff:g> om hier te speel"</string>
826826
<string name="media_transfer_playing_different_device" msgid="7186806382609785610">"Speel tans op <xliff:g id="DEVICENAME">%1$s</xliff:g>"</string>
827827
<string name="media_transfer_failed" msgid="7955354964610603723">"Iets is fout. Probeer weer."</string>
828+
<string name="controls_media_empty_title" msgid="8296102892421573325">"<xliff:g id="APP_NAME">%1$s</xliff:g> loop tans"</string>
828829
<string name="controls_error_timeout" msgid="794197289772728958">"Onaktief, gaan program na"</string>
829830
<string name="controls_error_removed" msgid="6675638069846014366">"Nie gekry nie"</string>
830831
<string name="controls_error_removed_title" msgid="1207794911208047818">"Kontrole is nie beskikbaar nie"</string>

‎packages/SystemUI/res/values-am/strings.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -825,6 +825,7 @@
825825
<string name="media_move_closer_to_end_cast" msgid="6495907340926563656">"እዚህ ለመጫወት ወደ <xliff:g id="DEVICENAME">%1$s</xliff:g> ቀረብ ይበሉ"</string>
826826
<string name="media_transfer_playing_different_device" msgid="7186806382609785610">"በ<xliff:g id="DEVICENAME">%1$s</xliff:g> ላይ በማጫወት ላይ"</string>
827827
<string name="media_transfer_failed" msgid="7955354964610603723">"የሆነ ችግር ተፈጥሯል። እንደገና ይሞክሩ።"</string>
828+
<string name="controls_media_empty_title" msgid="8296102892421573325">"<xliff:g id="APP_NAME">%1$s</xliff:g> እያሄደ ነው"</string>
828829
<string name="controls_error_timeout" msgid="794197289772728958">"ንቁ ያልኾነ፣ መተግበሪያን ይፈትሹ"</string>
829830
<string name="controls_error_removed" msgid="6675638069846014366">"አልተገኘም"</string>
830831
<string name="controls_error_removed_title" msgid="1207794911208047818">"መቆጣጠሪያ አይገኝም"</string>

‎packages/SystemUI/res/values-ar/strings.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -849,6 +849,7 @@
849849
<string name="media_move_closer_to_end_cast" msgid="6495907340926563656">"يُرجى الاقتراب من <xliff:g id="DEVICENAME">%1$s</xliff:g> لتشغيل الوسائط هنا."</string>
850850
<string name="media_transfer_playing_different_device" msgid="7186806382609785610">"جارٍ تشغيل الوسائط على <xliff:g id="DEVICENAME">%1$s</xliff:g>"</string>
851851
<string name="media_transfer_failed" msgid="7955354964610603723">"حدث خطأ. يُرجى إعادة المحاولة."</string>
852+
<string name="controls_media_empty_title" msgid="8296102892421573325">"\"<xliff:g id="APP_NAME">%1$s</xliff:g>\" قيد التشغيل"</string>
852853
<string name="controls_error_timeout" msgid="794197289772728958">"غير نشط، تحقّق من التطبيق."</string>
853854
<string name="controls_error_removed" msgid="6675638069846014366">"لم يتم العثور عليه."</string>
854855
<string name="controls_error_removed_title" msgid="1207794911208047818">"عنصر التحكّم غير متوفّر"</string>

0 commit comments

Comments
 (0)