summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-09-27Merge tag 'LA.QSSI.14.0.r1-17300-qssi.0' into uminekouminekoalk3pInjection
"LA.QSSI.14.0.r1-17300-qssi.0" Change-Id: I0efc791d35aa9ed19e87e9ef543fa9b290d74fd7
2024-09-11Merge 168c7058777df1542d17c74bfa62197a691ec726 on remote branchLinux Build Service Account
Change-Id: I3aae5c089f89bcb7aa2dfef846f6f3921a40d5b4
2024-09-10Fix IAE for bluetooth routes without set BT addressIván Budnik
This change just adds a last resort check to avoid the exception and fix the crash. Further checks will be added in the routing framework to avoid this incongruent state. Test: atest com.android.settingslib.media and manually with demo app Bug: 347499404 Flag: EXEMPT bugfix (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:ee6d33f4e29fe196c262a3c7051d34ef8f93a62f) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:800ba45f78de22893c982ac28e4c089ce5faf8f8) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:ca89bbb204cb355a164c61613f15214c607ad923) (cherry picked from commit 6e134dc065caa4756884cf3138917d8f5b54f717) Merged-In: I87e6810467bcae0bac7f0418217b03e57c1d8c03 Change-Id: I87e6810467bcae0bac7f0418217b03e57c1d8c03
2024-08-21Merge tag 'LA.QSSI.14.0.r1-16700-qssi.0' into uminekoalk3pInjection
LA.QSSI.14.0.r1-16700-qssi.0 Change-Id: I11f129bbee433e276ec242d66ebaa2e2c72d1b72
2024-08-20Snap for 12252919 from a48bc885464f2321ba8993d51b875117d0a83d5a to ↵Android Build Coastguard Worker
u-keystone-qcom-release Change-Id: I8916f1fe82eff7034918fafa9299f8cfccebec75
2024-08-19Merge u-mpr-2024-09Omkar sai sandeep
Change-Id: I10c727a6b6d9660173f441ccb72146f66948f1c3
2024-08-14Merge tag 'LA.QSSI.14.0.r1-16500-qssi.0' into uminekoalk3pInjection
LA.QSSI.14.0.r1-16500-qssi.0 Change-Id: Ie28e56853ef73fb1e575958a09a7179b3ee9cbeb
2024-08-12Merge 223d263c2a0a6d4adf58fc83b5c941d63ec2f9f3 on remote branchLinux Build Service Account
Change-Id: Ieb989907e2d78cdc1597863e7fcb165618a66f6e
2024-08-05Merge cherrypicks of ['googleplex-android-review.googlesource.com/28471034'] ↵Android Build Coastguard Worker
into udc-platform-release. Change-Id: Id6dca12670004eb6c054beb7d2bbcc0543e5f3f2
2024-08-05Fix IAE for bluetooth routes without set BT addressIván Budnik
This change just adds a last resort check to avoid the exception and fix the crash. Further checks will be added in the routing framework to avoid this incongruent state. Test: atest com.android.settingslib.media and manually with demo app Bug: 347499404 Flag: EXEMPT bugfix (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:ee6d33f4e29fe196c262a3c7051d34ef8f93a62f) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:800ba45f78de22893c982ac28e4c089ce5faf8f8) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:ca89bbb204cb355a164c61613f15214c607ad923) Merged-In: I87e6810467bcae0bac7f0418217b03e57c1d8c03 Change-Id: I87e6810467bcae0bac7f0418217b03e57c1d8c03
2024-07-29Merge 1002ddee3683f027baf121dc12ab44625ec47f73 on remote branchLinux Build Service Account
Change-Id: I6e2205c8656142aad4f46490292a639670fb2dc6
2024-07-26[coastguard skipped] Merge sparse cherrypicks from ↵Android Build Coastguard Worker
sparse-12144103-L00800030005440722 into udc-platform-release. COASTGUARD_SKIP: I8a273bccd490499b5551ab749a02f08b25412923 COASTGUARD_SKIP: I87e6810467bcae0bac7f0418217b03e57c1d8c03 Change-Id: I31e6224281b65317e0cf97a492259c61c92aa661
2024-07-26Merge cherrypicks of ['googleplex-android-review.googlesource.com/28471034'] ↵Android Build Coastguard Worker
into sparse-12144103-L00800030005440722. SPARSE_CHANGE: I87e6810467bcae0bac7f0418217b03e57c1d8c03 Change-Id: I8a273bccd490499b5551ab749a02f08b25412923
2024-07-26Fix IAE for bluetooth routes without set BT addressIván Budnik
This change just adds a last resort check to avoid the exception and fix the crash. Further checks will be added in the routing framework to avoid this incongruent state. Test: atest com.android.settingslib.media and manually with demo app Bug: 347499404 Flag: EXEMPT bugfix (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:ee6d33f4e29fe196c262a3c7051d34ef8f93a62f) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:800ba45f78de22893c982ac28e4c089ce5faf8f8) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:ca89bbb204cb355a164c61613f15214c607ad923) Merged-In: I87e6810467bcae0bac7f0418217b03e57c1d8c03 Change-Id: I87e6810467bcae0bac7f0418217b03e57c1d8c03
2024-07-22Snap for 12117360 from 92a4c78d68348345031f92ab49e9940d598baac1 to ↵Android Build Coastguard Worker
u-keystone-qcom-release Change-Id: Icaae0851634a7f7ca752fe975c58488f829ae2de
2024-07-17Merge u-mpr-2024-08Omkar sai sandeep
Change-Id: I44d04bd7606b6518ad1ec4e4341a46453176de68
2024-07-15Merge cherrypicks of ['googleplex-android-review.googlesource.com/27608978', ↵Android Build Coastguard Worker
'googleplex-android-review.googlesource.com/28044457'] into udc-platform-release. Change-Id: Ib308e3d4d979326ec87f3266a69991a82f83cde0
2024-07-15Delete keystore keys from RecoveryService.rebootRecoveryWithCommand()Nikolay Elenkov
Adds deleteSecrets() to RecoverySystemService. This method is called from rebootRecoveryWithCommand () before the --wipe_data command is passed to recovery and the device is force-rebooted. deleteSecerts() calls IKeystoreMaintenance.deleteAllKeys() in order to quickly destroy the keys protecting the synthetic password blobs used to derive FBE encryption keys. The intent is to make FBE-encrypted data unrecoverable even if the full data wipe in recovery is interrupted or skipped. Bug: 324321147 Test: Manual - System -> Reset options -> Erase all data. Test: Hold VolDown key to interrupt reboot and stop at bootloader screen. Test: fastboot oem bcd wipe command && fastboot oem bcd wipe recovery Test: fastboot reboot Test: Device reboots into recovery and prompts to factory reset: Test: 'Cannot load Android system. Your data may be corrupt. ...' (cherry picked from https://android-review.googlesource.com/q/commit:0d00031851e9f5d8ef93947205a7e8b5257f0d8d) Ignore-AOSP-First: Security fix backport (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c85d5febdc186f7fa1af2d0a6bdf705683437a98) Merged-In: I5eb8e97f3ae1a18d5e7e7c2c7eca048ebff3440a Change-Id: I5eb8e97f3ae1a18d5e7e7c2c7eca048ebff3440a
2024-07-15DO NOT MERGE Ignore - Sanitized uri scheme by removing scheme delimiterKiran Ramachandra
Initially considered removing unsupported characters as per IANA guidelines, but this could break applications that use custom schemes with asterisks. Instead, opted to remove only the "://" to minimize disruption Bug: 261721900 Test: atest FrameworksCoreTests:android.net.UriTest No-Typo-Check: The unit test is specifically written to test few cases, string "http://https://" is not a typo NOTE FOR REVIEWERS - original patch and result patch are not identical. PLEASE REVIEW CAREFULLY. Diffs between the patches: @AsbSecurityTest(cveBugId = 261721900) > + @SmallTest > + public void testSchemeSanitization() { > + Uri uri = new Uri.Builder() > + .scheme("http://https://evil.com:/te:st/") > + .authority("google.com").path("one/way").build(); > + assertEquals("httphttpsevil.com:/te:st/", uri.getScheme()); > + assertEquals("httphttpsevil.com:/te:st/://google.com/one/way", uri.toString()); > + } > + Original patch: diff --git a/core/java/android/net/Uri.java b/core/java/android/net/Uri.java old mode 100644 new mode 100644 --- a/core/java/android/net/Uri.java +++ b/core/java/android/net/Uri.java @@ -1388,7 +1388,11 @@ * @param scheme name or {@code null} if this is a relative Uri */ public Builder scheme(String scheme) { - this.scheme = scheme; + if (scheme != null) { + this.scheme = scheme.replace("://", ""); + } else { + this.scheme = null; + } return this; } diff --git a/core/tests/coretests/src/android/net/UriTest.java b/core/tests/coretests/src/android/net/UriTest.java old mode 100644 new mode 100644 --- a/core/tests/coretests/src/android/net/UriTest.java +++ b/core/tests/coretests/src/android/net/UriTest.java @@ -87,6 +87,16 @@ assertNull(u.getAuthority()); assertNull(u.getHost()); } + + @AsbSecurityTest(cveBugId = 261721900) + @SmallTest + public void testSc [[[Original patch trimmed due to size. Decoded string size: 1426. Decoded string SHA1: 55d69e9f854938457b2d98b18776898b16c2dd54.]]] Result patch: diff --git a/core/java/android/net/Uri.java b/core/java/android/net/Uri.java index 3da696a..f0262e9 100644 --- a/core/java/android/net/Uri.java +++ b/core/java/android/net/Uri.java @@ -1388,7 +1388,11 @@ * @param scheme name or {@code null} if this is a relative Uri */ public Builder scheme(String scheme) { - this.scheme = scheme; + if (scheme != null) { + this.scheme = scheme.replace("://", ""); + } else { + this.scheme = null; + } return this; } diff --git a/core/tests/coretests/src/android/net/UriTest.java b/core/tests/coretests/src/android/net/UriTest.java index 89632a4..8c130ee 100644 --- a/core/tests/coretests/src/android/net/UriTest.java +++ b/core/tests/coretests/src/android/net/UriTest.java @@ -88,6 +88,16 @@ assertNull(u.getHost()); } + @AsbSecurityTest(cveBugId = 261721900) + @SmallTest + public void testSchemeSanitization() { + Uri uri = new [[[Result patch trimmed due to size. Decoded string size: 1417. Decoded string SHA1: f9ce831a369872ae9bfd9f50f01dd394682e0f3f.]]] (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:557941ca0cf59da66db4fad12c2139ce80922f4a) Merged-In: Icab100bd4ae9b1c8245e6f891ad22101bda5eea5 Change-Id: Icab100bd4ae9b1c8245e6f891ad22101bda5eea5
2024-07-08Merge b2760deec932fcdd67bf542108d1fd3e58fa6f3b on remote branchLinux Build Service Account
Change-Id: I800f4b6b400a87e09540204c65d6e6d52b94da1e
2024-07-07Merge tag 'LA.QSSI.14.0.r1-15700-qssi.0' into uminekoalk3pInjection
LA.QSSI.14.0.r1-15700-qssi.0 Change-Id: I9cc03cc913a79466455d40729ecbf6c8aa3005a0
2024-06-27Snap for 12025157 from 1fddd82c00519578be77da423fbe76b0b329b79b to ↵Android Build Coastguard Worker
u-keystone-qcom-release Change-Id: Ic4a56417d6ca589d34f78dd7f68e2cde9e7d2e32
2024-06-25Merge u-mpr-2024-07Omkar Sai Sandeep Katadi
Change-Id: Ifa5f926af4a328d3c4ee611a0eb82e68d91239f1
2024-06-21base: Fix hearing aid mute issuegmanam
Hearing aid device connection will trigger postAccessoryPlugMediaUnmute but that doesnot have hearing aid device type CRs-Fixed:3725800 Change-Id: Iac45dafb5adf2ec60a9e4c89a6bab07337d05da8
2024-06-18Merge cherrypicks of ['googleplex-android-review.googlesource.com/27145545', ↵Android Build Coastguard Worker
'googleplex-android-review.googlesource.com/27266232', 'googleplex-android-review.googlesource.com/27316786', 'googleplex-android-review.googlesource.com/27431144', 'googleplex-android-review.googlesource.com/27146225', 'googleplex-android-review.googlesource.com/27263999', 'googleplex-android-review.googlesource.com/27214657'] into udc-platform-release. Change-Id: I62371a39bb6de6984d1fc33ff5ffe53ed4cdfc34
2024-06-18Fix READ/WRITE operation access issues on Restricted appOps.Hao Ke
Problems were identified around read and write access to the restricted appOps, this change includes: - Filter out restricted appOps status for unprivileged readers. - Allow additional privileged appOps permission holder reading restricted appOps status. Bug: 336273802 Bug: 336323279 Test: Local test see b/336273802#comment3 Test: atest AppOpsTest#testRestrictedSettingsOpsRead (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:e31c33ea3586531ca99dd4c6d68a34ce07c1cebb) Merged-In: I09008b365e36b2c20c9a1fe5a1d52699ddb17d35 Change-Id: I09008b365e36b2c20c9a1fe5a1d52699ddb17d35
2024-06-18Ensure device_owners2.xml is always written.Pavel Grafov
Bug: 335232744 Test: Manual, upgrading from T-QPR3 (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:3abc07421d5bed187589d6deb48da07e4c407203) Merged-In: I7a7dba56f2951e7e3699b19d2517d198dc8f9d35 Change-Id: I7a7dba56f2951e7e3699b19d2517d198dc8f9d35
2024-06-18Hide SAW subwindowsLinus Tufvesson
.. when top window is hidden through Window#setHideOverlayWindows Bug: 318683640 Test: atest CtsWindowManagerDeviceWindow:HideOverlayWindowsTest Flag: EXEMPT securityfix (cherry picked from commit c37bc9147086f497ac7b1595083836014f524d5f) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:55d02153259003b7552e7eef70b9e4f3f0dcd45c) Merged-In: If19240f5aec2e048de80d75cbbdc00be47622d7f Change-Id: If19240f5aec2e048de80d75cbbdc00be47622d7f
2024-06-18Add unit test to test data overflow when using BinaryXmlSerializerlpeter
Add the unit tests to test data overflow when calling: 1.BinaryXmlSerializer#attributeBytesHex 2.BinaryXmlSerializer#attributeBytesBase64 Bug: 307288067 Test: atest BinaryXmlTest (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:eebe3b8baf112082c3178ba7d17b5318c53b3b5f) Merged-In: I4e3f4881742f0e865eaefabb8ee134c67c6b53d9 Change-Id: I4e3f4881742f0e865eaefabb8ee134c67c6b53d9
2024-06-18Restrict USB poups while setup is in progressKiran S
Test: Cherry pick of http://ag/27094197 Bug: 294105066 (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:2ce2e54a040342373e401f9c2e70035ede4e63ad) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:71042ac086b3470f4086c5c76fc2b6c4e3dff263) Merged-In: I7d54534696fd73f3b94c5b4250142eed9341c5d8 Change-Id: I7d54534696fd73f3b94c5b4250142eed9341c5d8
2024-06-18Rate limiting PiP aspect ratio change requestHongwei Wang
Using CountQuotaTrack to limit how frequent an app can request aspect ratio change via PictureInPictureParams, which could result flood of PiP resizing requests and freeze the PiP window. Note that CountQuotaTrack is initialized out of the WM lock to avoid dead lock with the AM one. Bug: 283103220 Test: Manually, using the POC app Test: Manually, switching YT PiP video functions at a regular rate Test: atest WindowOrganizerTests ActivityThreadTest (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:8d814cc3b2fc94c8c47861abbcb3cec72aceb07e) Merged-In: Icb7dd17bbf7df573a9bb28f3dc56e90e78384f4f Change-Id: Icb7dd17bbf7df573a9bb28f3dc56e90e78384f4f
2024-06-18Security fix for VPN app killable via lockscreen.Faye Yan
Do not show the active apps dialog when the screen is locked. Instead prompt the user to unlock directly if clicked and only open the dialog on successsful unlock. Flag: NONE Bug: 304772709 Test: manually, locked and unlocked Test: atest com.android.systemui.qs.footer.ui.viewmodel.FooterActionsViewModelTest (cherry picked from commit d7628d5621c912399cefcddd9977199d62df320c) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:598d7a18601a04b9904f0e170cc7c1777a3389ff) Merged-In: I384699d478e5abcee3a165afc45211b9ed96334a Change-Id: I384699d478e5abcee3a165afc45211b9ed96334a
2024-06-17Snap for 11980515 from e7dceefe771ab02e620f731e5b220abf18f9df49 to ↵Android Build Coastguard Worker
u-keystone-qcom-release Change-Id: I6a9355eaa6d90654a7469f8ad92d596eca394dde
2024-06-07Merge 95a6b8d970fd1aa5333e75f190859fb4753b638f on remote branchLinux Build Service Account
Change-Id: I9b6dd4cefb74a078e09262e57306625b41e0ba06
2024-06-04base: Fix hearing aid mute issuegmanam
Hearing aid device connection will trigger postAccessoryPlugMediaUnmute but that doesnot have hearing aid device type CRs-Fixed:3725800 Change-Id: Iac45dafb5adf2ec60a9e4c89a6bab07337d05da8
2024-05-27Adjust max length of broadcast name to 32xiaowang
CRs-Fixed: 3659038 Change-Id: I6b7f380ea9a8cbb612a4a5c8a6e91808b4f9237c
2024-05-20Snap for 11864391 from 2ec92cb15ba5b0ea6080957ccb1b13dcdd3315a5 to ↵Android Build Coastguard Worker
u-keystone-qcom-release Change-Id: Iea82d32c17990688421f9d3f1f9b3ceff22c7552
2024-05-20Merge "Merge u-mpr-2024-06" into u-keystone-qcom-devOmkar Sai Sandeep Katadi
2024-05-20fw/b: Introduce dynamically themed bootanimationMaitreya29
Change-Id: Ic095ec6a55b97ac2943e5eb079068b271633547a Signed-off-by: Maitreya29 <maitreyapatni30@gmail.com>
2024-05-18Merge tag 'LA.QSSI.14.0.r1-14900-qssi.0' into uminekoalk3pInjection
LA.QSSI.14.0.r1-14900-qssi.0 Change-Id: Id79c99e182d30dc81784a6b8434eb6c1c06dfb29
2024-05-17Merge "Adjust max length of broadcast name to 32" into u-keystone-qcom-devTreehugger Robot
2024-05-17Merge "Disable following applications at runtime" into u-keystone-qcom-devTreehugger Robot
2024-05-17Merge u-mpr-2024-06Omkar Sai Sandeep Katadi
Change-Id: Ia3de13bfb4c43fd0fbd2744e0be6be81628b0e75
2024-05-14Merge cherrypicks of ['googleplex-android-review.googlesource.com/26695417', ↵Android Build Coastguard Worker
'googleplex-android-review.googlesource.com/26941037', 'googleplex-android-review.googlesource.com/26747994'] into udc-platform-release. Change-Id: Ib84302f5a29028663fbea36a4ab7b202c8de5b36
2024-05-14Verify UID of incoming Zygote connections.Martijn Coenen
Only the system UID should be allowed to connect to the Zygote. While for generic Zygotes this is also covered by SELinux policy, this is not true for App Zygotes: the preload code running in an app zygote could connect to another app zygote socket, if it had access to its (random) socket address. On the Java layer, simply check the UID when the connection is made. In the native layer, this check was already present, but it actually didn't work in the case where we receive a new incoming connection on the socket, and receive a 'non-fork' command: in that case, we will simply exit the native loop, and let the Java layer handle the command, without any further UID checking. Modified the native logic to drop new connections with a mismatching UID, and to keep serving the existing connection (if it was still there). Bug: 319081336 Test: manual (cherry picked from commit 2ffc7cb220e4220b7e108c4043a3f0f2a85b6508) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:e4b3ba817073b66ee37da8f1aba93b345309b435) Merged-In: I3f85a17107849e2cd3e82d6ef15c90b9e2f26532 Change-Id: I3f85a17107849e2cd3e82d6ef15c90b9e2f26532
2024-05-14Fix security vulnerability allowing apps to start from backgroundBishoy Gendy
Bug: 317048338 Test: Using the steps in b/317048338#comment12 (cherry picked from commit c5fc8ea92c0aabbb2fdccc23b743c18a8bf62e64) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:df3584bb93ab89d7e174f7d39e42d4b22cb92fe0) Merged-In: Ia91199fdb23beed27bde687fdca8fe5d3a5a4759 Change-Id: Ia91199fdb23beed27bde687fdca8fe5d3a5a4759
2024-05-14[PM] Send ACTION_PACKAGE_CHANGED when mimeGroups are changedIvan Chiang
Test: atest CtsPackageManagerTestCases:PackageManagerShellCommandMultiUserTest Test: atest CtsPackageManagerTestCases:PackageManagerTest Bug: 297517712 (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:81eb9f8294645684ce1fad39d5d4a00ef11736e4) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c160424ef22bffd25a9cc9bc7b901ae1b9721a72) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:4217415dbe8e83ba4c8bf56ac6ff21523187f59f) Merged-In: I271a3526ea4555249e3a2797605269257330e0e9 Change-Id: I271a3526ea4555249e3a2797605269257330e0e9
2024-05-10Merge 7cdb7b8c0c4e38c5e37cdfca6e19a2e3382c0d5c on remote branchLinux Build Service Account
Change-Id: Icb0aebdbc25d4e356ee71eb86f9d8556171c6e6f
2024-05-02Merge tag 'LA.QSSI.14.0.r1-14100-qssi.0' into uminekoalk3pInjection
LA.QSSI.14.0.r1-14100-qssi.0 Change-Id: Id064b3bced39edd1f99f84a7499d1a04a4fdb919
2024-05-02Merge cherrypicks of ['googleplex-android-review.googlesource.com/26677508', ↵Android Build Coastguard Worker
'googleplex-android-review.googlesource.com/26183005'] into udc-platform-release. Change-Id: Ibe2dcf92e96a3421f07db555174957f402f56415
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-03 00:11:05 +0000