131444d50077884daf4e00c097f1f2335c465c04 - platform_frameworks_base

commit	131444d50077884daf4e00c097f1f2335c465c04	[log] [tgz]
author	Robert Carr <racarr@google.com>	Sat Jan 22 17:28:19 2022 -0800
committer	Rob Carr <racarr@google.com>	Mon Jan 24 19:44:12 2022 +0000
tree	49fd46474bce4bbfc299aa2a7477b2e03a337470
parent	5cc27dd6ac14a421c20635bdd47dcd73df98aa6d [diff]

SurfaceControlViewHost: Restrict disclosure of input token

Currently we send the input (channel) token from the embedded
view hierarchy to the remote embedding process via SurfacePackage.
This is used to call grantEmbeddedWindowFocus. However this could also
allow the host process to invoke updateInputChannel, which is not
desirable. To fix this we rework updateInputChannel to work in terms
of a focusGrantToken, which only carries this 1 capability.
SurfacePackage is modified to not include the input token, but rather
include this focus grant token.

Bug: 215912712
Test: Existing tests pass
Change-Id: Ia9153c54e3e36e73c2b56763b96afab9e9f20d40

core/java/android/view/IWindowSession.aidl[diff]
core/java/android/view/SurfaceControlViewHost.java[diff]
core/java/android/view/WindowlessWindowManager.java[diff]
services/core/java/com/android/server/wm/EmbeddedWindowController.java[diff]
services/core/java/com/android/server/wm/Session.java[diff]
services/core/java/com/android/server/wm/WindowManagerService.java[diff]

6 files changed