From 985bdc676ac5ea4f35be4b56b74f723afe5b2af3 Mon Sep 17 00:00:00 2001 From: Dmitry Dementyev Date: Tue, 1 Oct 2024 14:57:44 -0700 Subject: [PATCH] Update checkKeyIntent 1) Explicityly set component after target activity check. 2) Update Intent subclass check. Bug: 360846772 Test: manual Flag: EXEMPT bugfix (cherry picked from commit cde345a7ee06db716e613e12a2c218ce248ad1c4) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:58f3d5b2226cc9c6dc9fcca1427eb6574dcc0eb8) Merged-In: Ied7961c73299681aa5b523cf3f00fd905893116f Change-Id: Ied7961c73299681aa5b523cf3f00fd905893116f --- .../android/server/accounts/AccountManagerService.java | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/accounts/AccountManagerService.java b/services/core/java/com/android/server/accounts/AccountManagerService.java index 6179b15334756..71ed5dbe8ab64 100644 --- a/services/core/java/com/android/server/accounts/AccountManagerService.java +++ b/services/core/java/com/android/server/accounts/AccountManagerService.java @@ -4978,6 +4978,8 @@ protected boolean checkKeyIntent(int authUid, Bundle bundle) { Log.e(TAG, String.format(tmpl, activityName, pkgName, mAccountType)); return false; } + intent.setComponent(targetActivityInfo.getComponentName()); + bundle.putParcelable(AccountManager.KEY_INTENT, intent); return true; } finally { Binder.restoreCallingIdentity(bid); @@ -4999,14 +5001,15 @@ private boolean checkKeyIntentParceledCorrectly(Bundle bundle) { Bundle simulateBundle = p.readBundle(); p.recycle(); Intent intent = bundle.getParcelable(AccountManager.KEY_INTENT, Intent.class); - if (intent != null && intent.getClass() != Intent.class) { - return false; - } Intent simulateIntent = simulateBundle.getParcelable(AccountManager.KEY_INTENT, Intent.class); if (intent == null) { return (simulateIntent == null); } + if (intent.getClass() != Intent.class || simulateIntent.getClass() != Intent.class) { + return false; + } + if (!intent.filterEquals(simulateIntent)) { return false; }