Enforce Network permission from external apps opening URL

GrapheneOS · May 10, 2024 · 67becc9 · 67becc9
1 parent 9f07a9b
commit 67becc9
Showing 1 changed file with 94 additions and 0 deletions.
diff --git a/patches/0174-Enforce-calling-app-Network-permission-for-calling-a.patch b/patches/0174-Enforce-calling-app-Network-permission-for-calling-a.patch
@@ -0,0 +1,94 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: fgei <[email protected]>
+Date: Wed, 1 May 2024 04:31:09 +0000
+Subject: [PATCH] Enforce calling app Network permission for calling app
+
+---
+ chrome/android/chrome_ext_deps.gni            |  1 +
+ .../browser/LaunchIntentDispatcher.java       | 18 ++++++++++++++++++
+ .../src/app/vanadium/ext/CustomOSApis.java    | 19 +++++++++++++++++++
+ 3 files changed, 38 insertions(+)
+
+diff --git a/chrome/android/chrome_ext_deps.gni b/chrome/android/chrome_ext_deps.gni
+index 522092c9820ce..d605c253df533 100644
+--- a/chrome/android/chrome_ext_deps.gni
++++ b/chrome/android/chrome_ext_deps.gni
+@@ -5,6 +5,7 @@
+ chrome_ext_deps = [
+   "//chrome/browser/subresource_filter/android:java",
+   "//vanadium/android_config/proto:browser_config_parser_java",
++  "//vanadium/ext/custom_os:custom_os_apis_java",
+ ]
+
+ chrome_ext_srcjar_deps = [
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java b/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
+index 3a7f27b80522a..e042acef84ef7 100644
+--- a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
++++ b/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
+@@ -4,6 +4,10 @@
+
+ package org.chromium.chrome.browser;
+
++import static android.Manifest.permission.INTERNET;
++import static app.vanadium.ext.CustomOSApis.checkLaunchedFromActivityPermission;
++import static app.vanadium.ext.CustomOSApis.PERMISSION_RESULT_UNKNOWN;
++
+ import android.annotation.SuppressLint;
+ import android.app.Activity;
+ import android.app.ActivityManager.RecentTaskInfo;
+@@ -156,6 +160,20 @@ public class LaunchIntentDispatcher {
+             url = IntentHandler.getUrlFromIntent(mIntent);
+         }
+
++        if (mActivity instanceof ChromeLauncherActivity) {
++            int permissionResult = checkLaunchedFromActivityPermission(mActivity, INTERNET);
++            if (permissionResult != PERMISSION_RESULT_UNKNOWN
++                    && permissionResult != PackageManager.PERMISSION_GRANTED) {
++                Intent redirectedIntent = new Intent(Intent.ACTION_MAIN);
++                redirectedIntent.setClass(
++                        ContextUtils.getApplicationContext(), SearchActivity.class);
++                redirectedIntent.putExtra(SearchManager.QUERY, url);
++                redirectedIntent.putExtra(IntentHandler.EXTRA_INCOGNITO_MODE, true);
++                mActivity.startActivity(redirectedIntent);
++                return Action.FINISH_ACTIVITY;
++            }
++        }
++
+         // Check if a web search Intent is being handled.
+         if (url == null
+                 && tabId == Tab.INVALID_TAB_ID
+diff --git a/vanadium/ext/custom_os/java/src/app/vanadium/ext/CustomOSApis.java b/vanadium/ext/custom_os/java/src/app/vanadium/ext/CustomOSApis.java
+index beaf2b4576207..06b3e69b08054 100644
+--- a/vanadium/ext/custom_os/java/src/app/vanadium/ext/CustomOSApis.java
++++ b/vanadium/ext/custom_os/java/src/app/vanadium/ext/CustomOSApis.java
+@@ -1,5 +1,6 @@
+ package app.vanadium.ext;
+
++import android.app.Activity;
+ import android.os.Environment;
+ import android.util.Log;
+
+@@ -26,4 +27,22 @@ public class CustomOSApis {
+         }
+     }
+
++    public static final int PERMISSION_RESULT_UNKNOWN = -100;
++
++    public static int checkLaunchedFromActivityPermission(Activity activity, String permission) {
++        try {
++            Method checkLaunchedFromPermission =
++                    Activity.class.getDeclaredMethod("checkLaunchedFromPermission", String.class);
++            if (checkLaunchedFromPermission.getReturnType() != Integer.TYPE) {
++                Log.e(TAG, "Unexpected return type: checkLaunchedFromPermission must return int");
++                return PERMISSION_RESULT_UNKNOWN;
++            }
++
++            var res = checkLaunchedFromPermission.invoke(activity, permission);
++            return (int) res;
++        } catch (NoSuchMethodException | InvocationTargetException | IllegalAccessException e) {
++            Log.e(TAG, "", e);
++            return PERMISSION_RESULT_UNKNOWN;
++        }
++    }
+ }
+\ No newline at end of file