Enforce Network permission from external apps opening URL

GrapheneOS · May 9, 2024 · 70a1e5b · 70a1e5b
1 parent b1a267b
commit 70a1e5b
Showing 1 changed file with 96 additions and 0 deletions.
diff --git a/patches/0173-Enforce-calling-app-Network-permission-for-calling-a.patch b/patches/0173-Enforce-calling-app-Network-permission-for-calling-a.patch
@@ -0,0 +1,96 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: fgei <[email protected]>
+Date: Wed, 1 May 2024 04:31:09 +0000
+Subject: [PATCH] Enforce calling app Network permission for calling app
+
+---
+ chrome/android/chrome_ext_deps.gni            |  1 +
+ .../browser/LaunchIntentDispatcher.java       | 19 ++++++++++++++++
+ .../src/app/vanadium/ext/CustomOSApis.java    | 22 ++++++++++++++++++-
+ 3 files changed, 41 insertions(+), 1 deletion(-)
+
+diff --git a/chrome/android/chrome_ext_deps.gni b/chrome/android/chrome_ext_deps.gni
+index 522092c9820ce..d605c253df533 100644
+--- a/chrome/android/chrome_ext_deps.gni
++++ b/chrome/android/chrome_ext_deps.gni
+@@ -5,6 +5,7 @@
+ chrome_ext_deps = [
+   "//chrome/browser/subresource_filter/android:java",
+   "//vanadium/android_config/proto:browser_config_parser_java",
++  "//vanadium/ext/custom_os:custom_os_apis_java",
+ ]
+
+ chrome_ext_srcjar_deps = [
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java b/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
+index 3a7f27b80522a..5300562d6ca65 100644
+--- a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
++++ b/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
+@@ -4,6 +4,10 @@
+
+ package org.chromium.chrome.browser;
+
++import static android.Manifest.permission.INTERNET;
++import static app.vanadium.ext.CustomOSApis.checkLaunchedFromActivityPermission;
++import static app.vanadium.ext.CustomOSApis.PERMISSION_RESULT_UNKNOWN;
++
+ import android.annotation.SuppressLint;
+ import android.app.Activity;
+ import android.app.ActivityManager.RecentTaskInfo;
+@@ -156,6 +160,21 @@ public class LaunchIntentDispatcher {
+             url = IntentHandler.getUrlFromIntent(mIntent);
+         }
+
++        if (mActivity instanceof ChromeLauncherActivity) {
++            int permissionResult = checkLaunchedFromActivityPermission(mActivity, INTERNET,
++                    Context.DEVICE_ID_DEFAULT);
++            if (permissionResult != PERMISSION_RESULT_UNKNOWN
++                    && permissionResult != PackageManager.PERMISSION_GRANTED) {
++                Intent redirectedIntent = new Intent(Intent.ACTION_MAIN);
++                redirectedIntent.setClass(
++                        ContextUtils.getApplicationContext(), SearchActivity.class);
++                redirectedIntent.putExtra(SearchManager.QUERY, url);
++                redirectedIntent.putExtra(IntentHandler.EXTRA_INCOGNITO_MODE, true);
++                mActivity.startActivity(redirectedIntent);
++                return Action.FINISH_ACTIVITY;
++            }
++        }
++
+         // Check if a web search Intent is being handled.
+         if (url == null
+                 && tabId == Tab.INVALID_TAB_ID
+diff --git a/vanadium/ext/custom_os/java/src/app/vanadium/ext/CustomOSApis.java b/vanadium/ext/custom_os/java/src/app/vanadium/ext/CustomOSApis.java
+index beaf2b4576207..7eea7db30d5df 100644
+--- a/vanadium/ext/custom_os/java/src/app/vanadium/ext/CustomOSApis.java
++++ b/vanadium/ext/custom_os/java/src/app/vanadium/ext/CustomOSApis.java
+@@ -1,5 +1,6 @@
+ package app.vanadium.ext;
+
++import android.app.Activity;
+ import android.os.Environment;
+ import android.util.Log;
+
+@@ -26,4 +27,23 @@ public class CustomOSApis {
+         }
+     }
+
++    public static final int PERMISSION_RESULT_UNKNOWN = -100;
++
++    public static int checkLaunchedFromActivityPermission(Activity activity,
++            String permission, int deviceId) {
++        try {
++            Method checkLaunchedFromPermission =
++                    Activity.class.getDeclaredMethod("checkLaunchedFromPermission", String.class);
++            if (checkLaunchedFromPermission.getReturnType() != Integer.TYPE) {
++                Log.e(TAG, "Unexpected return type: checkLaunchedFromPermission must return int");
++                return PERMISSION_RESULT_UNKNOWN;
++            }
++
++            var res = checkLaunchedFromPermission.invoke(activity, permission, deviceId);
++            return (int) res;
++        } catch (NoSuchMethodException | InvocationTargetException | IllegalAccessException e) {
++            Log.e(TAG, "", e);
++            return PERMISSION_RESULT_UNKNOWN;
++        }
++    }
+ }
+\ No newline at end of file