| commit | eccd83cf147fbd22d731477448b071fa17cf8a6a | [log] [tgz] |
|---|---|---|
| author | kumarashishg <kumarashishg@google.com> | Mon Jul 17 12:01:18 2023 +0000 |
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | Thu Jan 11 04:45:45 2024 +0000 |
| tree | 21cff3017198b4dd80e0ab0af1c7684a48a993ef | |
| parent | 09383fb3944bec246f710ffa357668b48325b0c6 [diff] |
Resolve custom printer icon boundary exploit. Because Settings grants the INTERACT_ACROSS_USERS_FULL permission, an exploit is possible where the third party print plugin service can pass other's User Icon URI. This CL provides a lightweight solution for parsing the image URI to detect profile exploitation. Bug: 281525042 Test: Build and flash the code. Try to reproduce the issue with mentioned steps in the bug (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:39f5737626ca644f41fda890c12518ce51875835) Merged-In: Iaaa6fe2a627a265c4d1d7b843a033a132e1fe2ce Change-Id: Iaaa6fe2a627a265c4d1d7b843a033a132e1fe2ce