6 months worth of security patches!#18

Open

Megh-Rana wants to merge 61 commits into

DerpFest-12:12.1from

Derpfest12-Revived:12.1

Commits on Aug 6, 2023

Revert "[RESTRICT AUTOMERGE] Trim the activity info of another uid if no privilege"

Louis Chang
authored and
Megh-Rana
committed
Move service initialization

Julia Reynolds
authored and
Megh-Rana
committed
Enable user graularity for lockdown mode

wenhao1006
authored and
Megh-Rana
committed
Reconcile WorkSource parcel and unparcel code.

Michael Wright
authored and
Megh-Rana
committed
Enforce MediaButtonReceiver extracted component name matches session package name

ivanbuper
authored and
Megh-Rana
committed
Enforce MediaButtonReceiver ComponentName belongs to app

ivanbuper
authored and
Megh-Rana
committed
Revert "Ensure that only SysUI can override pending intent launch flags"

Winson Chung
authored and
Megh-Rana
committed
DO NOT MERGE: Context#startInstrumentation could be started from SHELL only now.

Jing Ji
authored and
Megh-Rana
committed
Fix checkKeyIntentParceledCorrectly's bypass

haok-ggl
authored and
Megh-Rana
committed
Checking if package belongs to UID before registering broadcast receiver

Kunal Malhotra
authored and
Megh-Rana
committed
Encode Intent scheme when serializing to URI string RESTRICT AUTOMERGE

Winson Chiu
authored and
Megh-Rana
committed

Commits on Aug 8, 2023

[RESTRICT AUTOMERGE] Strip part of the activity info of another uid if no privilege

Louis Chang
authored and
Megh-Rana
committed
Add a limit on channel group creation

Julia Reynolds
authored and
Megh-Rana
committed
Fix bypass BAL via LocationManager.requestFlush

Kate Montgomery
authored and
Megh-Rana
committed
[RESTRICT AUTOMERGE] Fix bypass BG-FGS and BAL via package manager APIs

Rhed Jao
authored and
Megh-Rana
committed
Revert "Make Activites touch opaque - DO NOT MERGE"

jwdunlap
authored and
Megh-Rana
committed
[RESTRICT AUTOMERGE][pm] prevent system app downgrades of versions lower than preload

schfan-1
authored and
Megh-Rana
committed
[RESTRICT AUTOMERGE][pm] still allow debuggable for system app downgrades

schfan-1
authored and
Megh-Rana
committed
Checks if AccessibilityServiceInfo is within parcelable size.

Daniel-Norman
authored and
Megh-Rana
committed
Uri: check authority and scheme as part of determining URI path

ohodson
authored and
Megh-Rana
committed
enforce stricter rules when registering phoneAccounts

ThomasStuart
authored and
Megh-Rana
committed
Make Activites touch opaque - DO NOT MERGE

Linus Tufvesson
authored and
Megh-Rana
committed
Trim strings added to persistent snoozed notification storage.

Ioana Alexandru
authored and
Megh-Rana
committed
Limit the number of shortcuts per app that can be retained by system

pinyaoting
authored and
Megh-Rana
committed
Re-enforce MANAGE_ACTIVITY_TASKS for applySyncTransaction

Chris Li
authored and
Megh-Rana
committed
Remove Activity if it enters PiP without window

hwwang-google
authored and
Megh-Rana
committed
[DO NOT MERGE] Wait for preloading images to complete before inflating notifications

Valentin Iftime
authored and
Megh-Rana
committed
[DO NOT MERGE] Prevent RemoteViews crashing SystemUi

Valentin Iftime
authored and
Megh-Rana
committed
Grant MANAGE_USERS access to Traceur

kevinjeon-g
authored and
Megh-Rana
committed
Check key intent for selectors and prohibited flags

g-brnlee
authored and
Megh-Rana
committed
Handle invalid data during job loading.

kwadkore
authored and
Megh-Rana
committed
Allow filtering of services

Julia Reynolds
authored and
Megh-Rana
committed
Enforce DevicePolicyManager.setUserControlDisabledPackages in AppStandbyController

acjohnstong
authored and
Megh-Rana
committed
[RESTRICT AUTOMERGE] Add BubbleMetadata detection to block FSI

Jeff DeCew
authored and
Megh-Rana
committed
Prevent sharesheet from previewing unowned URIs

Mark Renouf
authored and
Megh-Rana
committed
Sanitize VPN label to prevent HTML injection

Lucas Lin
authored and
Megh-Rana
committed
Limit the number of supported v1 and v2 signers

mpgroover
authored and
Megh-Rana
committed
Grant URI permissions to the CallStyle-related ones

Matías Hernández
authored and
Megh-Rana
committed
Only allow NEW_TASK flag when adjusting pending intents

Winson Chung
authored and
Megh-Rana
committed
Dismiss keyguard when simpin auth'd and...

Aaron Liu
authored and
Megh-Rana
committed
Verify URI permissions for EXTRA_REMOTE_INPUT_HISTORY_ITEMS.

Ioana Alexandru
authored and
Megh-Rana
committed
Truncate ShortcutInfo Id

András Kurucz
authored and
Megh-Rana
committed
Visit URIs in landscape/portrait custom remote views.

Ioana Alexandru
authored and
Megh-Rana
committed
[DO NOT MERGE] Backport BAL restrictions from T to S, this blocks apps from using Alarm

Christophe Pinelli
authored and
Megh-Rana
committed

Commits on Aug 13, 2023

DO NOT MERGE: ActivityManager#killBackgroundProcesses can kill caller's own app only

Jing Ji
authored and
Megh-Rana
committed
ActivityManagerService: Allow openContentUri from vendor/system/product.

gborgera2
authored and
Megh-Rana
committed
Do not load drawable for wallet card if the card image icon iscreated

Silin Huang
authored and
Megh-Rana
committed
Verify URI permissions for notification shortcutIcon.

Ioana Alexandru
authored and
Megh-Rana
committed
Ensure policy has no absurdly long strings

Pavel Grafov
authored and
Megh-Rana
committed
On device lockdown, always show the keyguard

Beverly
authored and
Megh-Rana
committed
Preserve flags for non-runtime permissions upon package update.

zhanghai
authored and
Megh-Rana
committed
Check URIs in notification public version.

Ioana Alexandru
authored and
Megh-Rana
committed
Implement visitUris for RemoteViews ViewGroupActionAdd.

Ioana Alexandru
authored and
Megh-Rana
committed
Validate ComponentName for MediaButtonBroadcastReceiver

ivanbuper
authored and
Megh-Rana
committed
Check URIs in sized remote views.

Ioana Alexandru
authored and
Megh-Rana
committed
Fix PrivacyChip not visible issue

Johannes Gallmann
authored and
Megh-Rana
committed
Visit URIs in themed remoteviews icons.

Ioana Alexandru
authored and
Megh-Rana
committed
Merge "Use Settings.System.getIntForUser instead of getInt to make sure user specific settings are used" into rvc-dev am: d198f5165c am: 886d492c8c

Treehugger Robot
authored and
Megh-Rana
committed
Remove unnecessary padding code

Lee Shombert
authored and
Megh-Rana
committed
Verify URI permissions in MediaMetadata

Michael Mikhail
authored and
Megh-Rana
committed
Merge "Resolve StatusHints image exploit across user." into rvc-dev am: 543e6febbf am: 8c3d465b5e

Pranav Madapurmath
authored and
Megh-Rana
committed