| commit | 63b6ab6176d1d608d83d9ab73bc556f3aee6f8ee | [log] [tgz] |
|---|---|---|
| author | Pinyao Ting <pinyaoting@google.com> | Thu Jun 01 18:12:44 2023 -0700 |
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | Fri Sep 01 12:05:34 2023 +0000 |
| tree | 1554435a5363eb8c07f235003aeabef981c47bc8 | |
| parent | 8e6b5824dabe7a152e3b7cec256edf68d24f752e [diff] |
[RESTRICT AUTOMERGE] Fix permission issue in legacy shortcut When building legacy shortcut, Launcher calls PackageManager#resolveActivity to retrieve necessary permission to launch the intent. However, when the source app wraps an arbitrary intent within Intent#createChooser, the existing logic will fail because launching Chooser doesn't require additional permission. This CL fixes the security vulnerability by performing the permission check against the intent that is wrapped within. Bug: 270152142 Test: manual (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:f0261b5b38cd95bc1522780a7538a5f4ddc1b119) Merged-In: I05ccbde0a873569f24af4d3675a86830ba54c43f Change-Id: I05ccbde0a873569f24af4d3675a86830ba54c43f