activities from background
Remove whitelisting privilege from deleteIntent before it's
sent in cancelNotificationLocked().
Bug:
130619912
Test: manual (with a custom built app that provides
PendingIntent.getActivity() to
Notification.Builder.setDeleteIntent())
Change-Id: I8a85b4c32717f958c4ee2fe040b73bceb96d7feb
IIntentSender target, IBinder whitelistToken, int flags);
/**
+ * Voids {@link PendingIntent}'s privilege to be whitelisted to start activities from
+ * background.
+ */
+ public abstract void clearPendingIntentAllowBgActivityStarts(IIntentSender target,
+ IBinder whitelistToken);
+
+ /**
* Allow DeviceIdleController to tell us about what apps are whitelisted.
*/
public abstract void setDeviceIdleWhitelist(int[] allAppids, int[] exceptIdleAppids);
}
@Override
+ public void clearPendingIntentAllowBgActivityStarts(IIntentSender target,
+ IBinder whitelistToken) {
+ if (!(target instanceof PendingIntentRecord)) {
+ Slog.w(TAG, "clearPendingIntentAllowBgActivityStarts():"
+ + " not a PendingIntentRecord: " + target);
+ return;
+ }
+ synchronized (ActivityManagerService.this) {
+ ((PendingIntentRecord) target).clearAllowBgActivityStarts(whitelistToken);
+ }
+ }
+
+ @Override
public void setDeviceIdleWhitelist(int[] allAppids, int[] exceptIdleAppids) {
synchronized (ActivityManagerService.this) {
mDeviceIdleWhitelist = allAppids;
}
}
+ void clearAllowBgActivityStarts(IBinder token) {
+ if (token == null) return;
+ mAllowBgActivityStartsForActivitySender.remove(token);
+ mAllowBgActivityStartsForBroadcastSender.remove(token);
+ mAllowBgActivityStartsForServiceSender.remove(token);
+ }
+
public void registerCancelListenerLocked(IResultReceiver receiver) {
if (mCancelCallbacks == null) {
mCancelCallbacks = new RemoteCallbackList<>();
// tell the app
if (sendDelete) {
- if (r.getNotification().deleteIntent != null) {
+ final PendingIntent deleteIntent = r.getNotification().deleteIntent;
+ if (deleteIntent != null) {
try {
- r.getNotification().deleteIntent.send();
+ // make sure deleteIntent cannot be used to start activities from background
+ LocalServices.getService(ActivityManagerInternal.class)
+ .clearPendingIntentAllowBgActivityStarts(deleteIntent.getTarget(),
+ WHITELIST_TOKEN);
+ deleteIntent.send();
} catch (PendingIntent.CanceledException ex) {
// do nothing - there's no relevant way to recover, and
// no reason to let this propagate