aixan/lawnchair
1
0
Fork 0
mirror of https://github.com/LawnchairLauncher/lawnchair.git synced 2026-02-20 03:08:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Preventing a shortcut which requires permissions from being added to

Browse Source 
homescreen

A shortcut can be added by any app as INSTALL_SHORTCUT is a normal
level permission. But the intent is actually launched by the launcher
app which can have other permission as well.

> When adding a shortcut from the broadcast, verify that the intent does
not require any permission
> When adding a shortcut using the two-step drop process, verify that
the source app also has the permission to create such a shortcut

Bug: 30778130
Change-Id: I710a490d69019dc25709db5a97020c20d9325007
This commit is contained in:
Sunny Goyal
2016-09-08 14:32:06 -07:00
parent add78abb98
commit fb5096d07b
3 changed files with 77 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/com/android/launcher3/InstallShortcutReceiver.java
View File

@@ -33,6 +33,7 @@ import com.android.launcher3.compat.LauncherActivityInfoCompat;
import com.android.launcher3.compat.LauncherAppsCompat;
import com.android.launcher3.compat.UserHandleCompat;
import com.android.launcher3.compat.UserManagerCompat;
import com.android.launcher3.util.PackageManagerHelper;
import com.android.launcher3.util.Thunk;
import org.json.JSONException;
@@ -146,6 +147,15 @@ public class InstallShortcutReceiver extends BroadcastReceiver {
}
PendingInstallShortcutInfo info = createPendingInfo(context, data);
if (info != null) {
if (!info.isLauncherActivity()) {
// Since its a custom shortcut, verify that it is safe to launch.
if (!PackageManagerHelper.hasPermissionForActivity(
context, info.launchIntent, null)) {
// Target cannot be launched, or requires some special permission to launch
Log.e(TAG, "Ignoring malicious intent " + info.launchIntent.toUri(0));
return;
}
}
queuePendingShortcutInfo(info, context);
}
}