Skip to content

Commit 90e095d

Browse files
author
Edgar Wang
committed
Fix LaunchAnyWhere in AppRestrictionsFragment
If the intent's package equals to the app's package, this intent will be allowed to startActivityForResult. But this check is unsafe, because if the component of this intent is set, the package field will just be ignored. So if we set the component to any activity we like and set package to the app's package, it will pass the assertSafeToStartCustomActivity check and now we can launch anywhere. Bug: 223578534 Test: robotest and manual verify Change-Id: I40496105bae313fe5cff2a36dfe329c1e2b5bbe4
1 parent 444e9d3 commit 90e095d

File tree

1 file changed

+1
-4
lines changed

1 file changed

+1
-4
lines changed

src/com/android/settings/users/AppRestrictionsFragment.java

+1-4
Original file line numberDiff line numberDiff line change
@@ -661,10 +661,7 @@ public void onReceive(Context context, Intent intent) {
661661
}
662662

663663
private void assertSafeToStartCustomActivity(Intent intent) {
664-
// Activity can be started if it belongs to the same app
665-
if (intent.getPackage() != null && intent.getPackage().equals(packageName)) {
666-
return;
667-
}
664+
EventLog.writeEvent(0x534e4554, "223578534", -1 /* UID */, "");
668665
ResolveInfo resolveInfo = mPackageManager.resolveActivity(
669666
intent, PackageManager.MATCH_DEFAULT_ONLY);
670667

0 commit comments

Comments
 (0)