commit e50073ba627f6d30dc76f5a1566e071e7773f76d
author calvinpan <calvinpan@google.com> Mon Jul 20 15:05:08 2020 +0800
committer Calvin Pan <calvinpan@google.com> Tue Jul 28 01:19:54 2020 +0000
tree 6b5478cb35e4633c1f39d19b8b4488cb23a686ff
parent 2281fff4c776d960a3b005c8c2c1a5cacf905a54

Fix URL_TELEPHONY_USING_SUBID return incorrect subid's APN

URL_TELEPHONY_USING_SUBID only return the result that queried by
mcc/mnc. If there are two different carrier have same mcc/mnc,
TelephonyProvider will return all of APN to user.

Fix:
1. Return the result that queried by mcc/mnc and mvmo.
2. Add clearCallingIdentity() to prevent third party app can't query by
this URL.

Bug: 161394004
Test: By manual and atest
1. Insert an APN that MCC/MNC same as current sim
2. Query by URL_TELEPHONY_USING_SUBID and check the result

Change-Id: I43bed10482a9eb18d6d30782e494c08e2ea7edf1

src/com/android/providers/telephony/TelephonyProvider.java

diff --git a/src/com/android/providers/telephony/TelephonyProvider.java b/src/com/android/providers/telephony/TelephonyProvider.java
index b7d7586..65e577e 100644
--- a/src/com/android/providers/telephony/TelephonyProvider.java
+++ b/src/com/android/providers/telephony/TelephonyProvider.java
@@ -2930,6 +2930,7 @@
         checkPermissionCompat(match, projectionIn);
         switch (match) {
             case URL_TELEPHONY_USING_SUBID: {
+                // The behaves exactly same as URL_SIM_APN_LIST_ID.
                 subIdString = url.getLastPathSegment();
                 try {
                     subId = Integer.parseInt(subIdString);
@@ -2938,13 +2939,13 @@
                     return null;
                 }
                 if (DBG) log("subIdString = " + subIdString + " subId = " + subId);
-                TelephonyManager telephonyManager = getContext()
-                    .getSystemService(TelephonyManager.class).createForSubscriptionId(subId);
-                constraints.add(NUMERIC + " = '" + telephonyManager.getSimOperator() + "'");
+                qb.appendWhereStandalone(IS_NOT_OWNED_BY_DPC);
+                return getSubscriptionMatchingAPNList(qb, projectionIn, selection, selectionArgs,
+                        sort, subId);
+
                 // TODO b/74213956 turn this back on once insertion includes correct sub id
                 // constraints.add(SUBSCRIPTION_ID + "=" + subIdString);
             }
-            // intentional fall through from above case
             case URL_TELEPHONY: {
                 constraints.add(IS_NOT_OWNED_BY_DPC);
                 break;
@@ -3203,10 +3204,19 @@
                 data.add(ret.getString(ret.getColumnIndex(column)));
             }
 
+            boolean isCurrentSimOperator;
+            final long identity = Binder.clearCallingIdentity();
+            try {
+                isCurrentSimOperator = tm.matchesCurrentSimOperator(
+                        ret.getString(numericIndex),
+                        getMvnoTypeIntFromString(ret.getString(mvnoIndex)),
+                        ret.getString(mvnoDataIndex));
+            } finally {
+                Binder.restoreCallingIdentity(identity);
+            }
+
             boolean isMVNOAPN = !TextUtils.isEmpty(ret.getString(numericIndex))
-                    && tm.matchesCurrentSimOperator(ret.getString(numericIndex),
-                            getMvnoTypeIntFromString(ret.getString(mvnoIndex)),
-                            ret.getString(mvnoDataIndex));
+                    && isCurrentSimOperator;
             boolean isMNOAPN = !TextUtils.isEmpty(ret.getString(numericIndex))
                     && ret.getString(numericIndex).equals(mccmnc)
                     && TextUtils.isEmpty(ret.getString(mvnoIndex));