Skip to content
Commit cb419edf authored by Azhara Assanova's avatar Azhara Assanova
Browse files

Make mutable implicit PendingIntent immutable

Starting from target SDK U, we will block creation of mutable
PendingIntents with implicit Intents because attackers can mutate the
Intent object within and launch altered behavior on behalf of victim
apps. For more details on the vulnerability, see go/pendingintent-rca.

From a quick analysis, we concluded that the PendingIntent here is only
mutated with flags from fillInIntent, so we added them to the intent
inside and made the PendingIntent immutable.

Reviewers, please call out if this is not the case.

Bug: 236704164
Bug: 229362273
Test: CtsVerifier: Bubble Notification Tests
Test: atest frameworks/base/libs/WindowManager/Shell/tests/unittest/src/com/android/wm/shell/bubbles
Change-Id: Idda5868f193070908afd435cedac72a03b6c4439
parent 397065c0
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment