1 /* 2 * Copyright (C) 2023 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 package android.content.res; 18 19 import static android.os.SystemProperties.PROP_VALUE_MAX; 20 21 import android.annotation.NonNull; 22 import android.ravenwood.annotation.RavenwoodKeepWholeClass; 23 import android.util.Pools.SimplePool; 24 import android.util.Slog; 25 26 import androidx.annotation.StyleableRes; 27 28 import com.android.internal.R; 29 30 import java.util.Set; 31 32 /** 33 * Defines the string attribute length and child tag count restrictions for a xml element. 34 * 35 * {@hide} 36 */ 37 @RavenwoodKeepWholeClass 38 public class Element { 39 private static final int DEFAULT_MAX_STRING_ATTR_LENGTH = 32_768; 40 private static final int MAX_POOL_SIZE = 128; 41 private static final int MAX_ATTR_LEN_URL_COMPONENT = 256; 42 private static final int MAX_ATTR_LEN_PERMISSION_GROUP = 256; 43 private static final int MAX_ATTR_LEN_PACKAGE = 256; 44 /** 45 * The mime type max length restriction here should match the restriction that is also 46 * placed in {@link android.content.pm.PackageManager#setMimeGroup(String, Set)} 47 */ 48 private static final int MAX_ATTR_LEN_MIMETYPE = 255; 49 private static final int MAX_ATTR_LEN_NAME = 1024; 50 private static final int MAX_ATTR_LEN_PATH = 4000; 51 private static final int MAX_ATTR_LEN_VALUE = 32_768; 52 53 private static final int MAX_TOTAL_META_DATA_SIZE = 262_144; 54 55 private static final String BAD_COMPONENT_NAME_CHARS = ";,[](){}:?%^*|/\\"; 56 57 private static final String TAG = "PackageParsing"; 58 protected static final String TAG_ACTION = "action"; 59 protected static final String TAG_ACTIVITY = "activity"; 60 protected static final String TAG_ADOPT_PERMISSIONS = "adopt-permissions"; 61 protected static final String TAG_ACTIVITY_ALIAS = "activity-alias"; 62 protected static final String TAG_APPLICATION = "application"; 63 protected static final String TAG_ATTRIBUTION = "attribution"; 64 protected static final String TAG_CATEGORY = "category"; 65 protected static final String TAG_COMPATIBLE_SCREENS = "compatible-screens"; 66 protected static final String TAG_DATA = "data"; 67 protected static final String TAG_EAT_COMMENT = "eat-comment"; 68 protected static final String TAG_FEATURE_GROUP = "feature-group"; 69 protected static final String TAG_GRANT_URI_PERMISSION = "grant-uri-permission"; 70 protected static final String TAG_INSTRUMENTATION = "instrumentation"; 71 protected static final String TAG_INTENT = "intent"; 72 protected static final String TAG_INTENT_FILTER = "intent-filter"; 73 protected static final String TAG_KEY_SETS = "key-sets"; 74 protected static final String TAG_LAYOUT = "layout"; 75 protected static final String TAG_MANIFEST = "manifest"; 76 protected static final String TAG_META_DATA = "meta-data"; 77 protected static final String TAG_ORIGINAL_PACKAGE = "original-package"; 78 protected static final String TAG_OVERLAY = "overlay"; 79 protected static final String TAG_PACKAGE = "package"; 80 protected static final String TAG_PACKAGE_VERIFIER = "package-verifier"; 81 protected static final String TAG_PATH_PERMISSION = "path-permission"; 82 protected static final String TAG_PERMISSION = "permission"; 83 protected static final String TAG_PERMISSION_GROUP = "permission-group"; 84 protected static final String TAG_PERMISSION_TREE = "permission-tree"; 85 protected static final String TAG_PROFILEABLE = "profileable"; 86 protected static final String TAG_PROTECTED_BROADCAST = "protected-broadcast"; 87 protected static final String TAG_PROPERTY = "property"; 88 protected static final String TAG_PROVIDER = "provider"; 89 protected static final String TAG_QUERIES = "queries"; 90 protected static final String TAG_RECEIVER = "receiver"; 91 protected static final String TAG_RESTRICT_UPDATE = "restrict-update"; 92 protected static final String TAG_SCREEN = "screen"; 93 protected static final String TAG_SERVICE = "service"; 94 protected static final String TAG_SUPPORT_SCREENS = "supports-screens"; 95 protected static final String TAG_SUPPORTS_GL_TEXTURE = "supports-gl-texture"; 96 protected static final String TAG_SUPPORTS_INPUT = "supports-input"; 97 protected static final String TAG_SUPPORTS_SCREENS = "supports-screens"; 98 protected static final String TAG_URI_RELATIVE_FILTER_GROUP = "uri-relative-filter-group"; 99 protected static final String TAG_USES_CONFIGURATION = "uses-configuration"; 100 protected static final String TAG_USES_FEATURE = "uses-feature"; 101 protected static final String TAG_USES_GL_TEXTURE = "uses-gl-texture"; 102 protected static final String TAG_USES_LIBRARY = "uses-library"; 103 protected static final String TAG_USES_NATIVE_LIBRARY = "uses-native-library"; 104 protected static final String TAG_USES_PERMISSION = "uses-permission"; 105 protected static final String TAG_USES_PERMISSION_SDK_23 = "uses-permission-sdk-23"; 106 protected static final String TAG_USES_PERMISSION_SDK_M = "uses-permission-sdk-m"; 107 protected static final String TAG_USES_SDK = "uses-sdk"; 108 protected static final String TAG_USES_SPLIT = "uses-split"; 109 110 protected static final String TAG_ATTR_BACKUP_AGENT = "backupAgent"; 111 protected static final String TAG_ATTR_CATEGORY = "category"; 112 protected static final String TAG_ATTR_FRAGMENT = "fragment"; 113 protected static final String TAG_ATTR_FRAGMENT_ADVANCED_PATTERN = "fragmentAdvancedPattern"; 114 protected static final String TAG_ATTR_FRAGMENT_PATTERN = "fragmentPattern"; 115 protected static final String TAG_ATTR_FRAGMENT_PREFIX = "fragmentPrefix"; 116 protected static final String TAG_ATTR_FRAGMENT_SUFFIX = "fragmentSuffix"; 117 protected static final String TAG_ATTR_HOST = "host"; 118 protected static final String TAG_ATTR_MANAGE_SPACE_ACTIVITY = "manageSpaceActivity"; 119 protected static final String TAG_ATTR_MIMETYPE = "mimeType"; 120 protected static final String TAG_ATTR_MIMEGROUP = "mimeGroup"; 121 protected static final String TAG_ATTR_NAME = "name"; 122 protected static final String TAG_ATTR_PACKAGE = "package"; 123 protected static final String TAG_ATTR_PATH = "path"; 124 protected static final String TAG_ATTR_PATH_ADVANCED_PATTERN = "pathAdvancedPattern"; 125 protected static final String TAG_ATTR_PATH_PATTERN = "pathPattern"; 126 protected static final String TAG_ATTR_PATH_PREFIX = "pathPrefix"; 127 protected static final String TAG_ATTR_PATH_SUFFIX = "pathSuffix"; 128 protected static final String TAG_ATTR_PARENT_ACTIVITY_NAME = "parentActivityName"; 129 protected static final String TAG_ATTR_PERMISSION = "permission"; 130 protected static final String TAG_ATTR_PERMISSION_GROUP = "permissionGroup"; 131 protected static final String TAG_ATTR_PORT = "port"; 132 protected static final String TAG_ATTR_PROCESS = "process"; 133 protected static final String TAG_ATTR_QUERY = "query"; 134 protected static final String TAG_ATTR_QUERY_ADVANCED_PATTERN = "queryAdvancedPattern"; 135 protected static final String TAG_ATTR_QUERY_PATTERN = "queryPattern"; 136 protected static final String TAG_ATTR_QUERY_PREFIX = "queryPrefix"; 137 protected static final String TAG_ATTR_QUERY_SUFFIX = "querySuffix"; 138 protected static final String TAG_ATTR_READ_PERMISSION = "readPermission"; 139 protected static final String TAG_ATTR_REQUIRED_ACCOUNT_TYPE = "requiredAccountType"; 140 protected static final String TAG_ATTR_REQUIRED_SYSTEM_PROPERTY_NAME = 141 "requiredSystemPropertyName"; 142 protected static final String TAG_ATTR_REQUIRED_SYSTEM_PROPERTY_VALUE = 143 "requiredSystemPropertyValue"; 144 protected static final String TAG_ATTR_RESTRICTED_ACCOUNT_TYPE = "restrictedAccountType"; 145 protected static final String TAG_ATTR_SCHEME = "scheme"; 146 protected static final String TAG_ATTR_SHARED_USER_ID = "sharedUserId"; 147 protected static final String TAG_ATTR_TARGET_ACTIVITY = "targetActivity"; 148 protected static final String TAG_ATTR_TARGET_NAME = "targetName"; 149 protected static final String TAG_ATTR_TARGET_PACKAGE = "targetPackage"; 150 protected static final String TAG_ATTR_TARGET_PROCESSES = "targetProcesses"; 151 protected static final String TAG_ATTR_TASK_AFFINITY = "taskAffinity"; 152 protected static final String TAG_ATTR_VALUE = "value"; 153 protected static final String TAG_ATTR_VERSION_NAME = "versionName"; 154 protected static final String TAG_ATTR_WRITE_PERMISSION = "writePermission"; 155 protected static final String TAG_ATTR_ZYGOTE_PRELOAD_NAME = "zygotePreloadName"; 156 157 // The length of mTagCounters corresponds to the number of tags defined in getCounterIdx. If new 158 // tags are added then the size here should be increased to match. 159 private final TagCounter[] mTagCounters = new TagCounter[35]; 160 161 String mTag; 162 163 private static final ThreadLocal<SimplePool<Element>> sPool = 164 ThreadLocal.withInitial(() -> new SimplePool<>(MAX_POOL_SIZE)); 165 166 @NonNull obtain(@onNull String tag)167 static Element obtain(@NonNull String tag) { 168 Element element = sPool.get().acquire(); 169 if (element == null) { 170 element = new Element(); 171 } 172 element.init(tag); 173 return element; 174 } 175 recycle()176 void recycle() { 177 mTag = null; 178 sPool.get().release(this); 179 } 180 181 private long mChildTagMask = 0; 182 private int mTotalComponentMetadataSize = 0; 183 getCounterIdx(String tag)184 private static int getCounterIdx(String tag) { 185 switch(tag) { 186 case TAG_LAYOUT: 187 return 0; 188 case TAG_META_DATA: 189 return 1; 190 case TAG_INTENT_FILTER: 191 return 2; 192 case TAG_PROFILEABLE: 193 return 3; 194 case TAG_USES_NATIVE_LIBRARY: 195 return 4; 196 case TAG_RECEIVER: 197 return 5; 198 case TAG_SERVICE: 199 return 6; 200 case TAG_ACTIVITY_ALIAS: 201 return 7; 202 case TAG_USES_LIBRARY: 203 return 8; 204 case TAG_PROVIDER: 205 return 9; 206 case TAG_ACTIVITY: 207 return 10; 208 case TAG_ACTION: 209 return 11; 210 case TAG_CATEGORY: 211 return 12; 212 case TAG_DATA: 213 return 13; 214 case TAG_APPLICATION: 215 return 14; 216 case TAG_OVERLAY: 217 return 15; 218 case TAG_INSTRUMENTATION: 219 return 16; 220 case TAG_PERMISSION_GROUP: 221 return 17; 222 case TAG_PERMISSION_TREE: 223 return 18; 224 case TAG_SUPPORTS_GL_TEXTURE: 225 return 19; 226 case TAG_SUPPORTS_SCREENS: 227 return 20; 228 case TAG_USES_CONFIGURATION: 229 return 21; 230 case TAG_USES_SDK: 231 return 22; 232 case TAG_COMPATIBLE_SCREENS: 233 return 23; 234 case TAG_QUERIES: 235 return 24; 236 case TAG_ATTRIBUTION: 237 return 25; 238 case TAG_USES_FEATURE: 239 return 26; 240 case TAG_PERMISSION: 241 return 27; 242 case TAG_USES_PERMISSION: 243 case TAG_USES_PERMISSION_SDK_23: 244 case TAG_USES_PERMISSION_SDK_M: 245 return 28; 246 case TAG_GRANT_URI_PERMISSION: 247 return 29; 248 case TAG_PATH_PERMISSION: 249 return 30; 250 case TAG_PACKAGE: 251 return 31; 252 case TAG_INTENT: 253 return 32; 254 case TAG_URI_RELATIVE_FILTER_GROUP: 255 return 33; 256 default: 257 // The size of the mTagCounters array should be equal to this value+1 258 return 34; 259 } 260 } 261 shouldValidate(String tag)262 static boolean shouldValidate(String tag) { 263 switch (tag) { 264 case TAG_ACTION: 265 case TAG_ACTIVITY: 266 case TAG_ACTIVITY_ALIAS: 267 case TAG_APPLICATION: 268 case TAG_ATTRIBUTION: 269 case TAG_CATEGORY: 270 case TAG_COMPATIBLE_SCREENS: 271 case TAG_DATA: 272 case TAG_GRANT_URI_PERMISSION: 273 case TAG_INSTRUMENTATION: 274 case TAG_INTENT: 275 case TAG_INTENT_FILTER: 276 case TAG_LAYOUT: 277 case TAG_MANIFEST: 278 case TAG_META_DATA: 279 case TAG_OVERLAY: 280 case TAG_PACKAGE: 281 case TAG_PATH_PERMISSION: 282 case TAG_PERMISSION: 283 case TAG_PERMISSION_GROUP: 284 case TAG_PERMISSION_TREE: 285 case TAG_PROFILEABLE: 286 case TAG_PROPERTY: 287 case TAG_PROVIDER: 288 case TAG_QUERIES: 289 case TAG_RECEIVER: 290 case TAG_SCREEN: 291 case TAG_SERVICE: 292 case TAG_SUPPORTS_GL_TEXTURE: 293 case TAG_SUPPORTS_SCREENS: 294 case TAG_URI_RELATIVE_FILTER_GROUP: 295 case TAG_USES_CONFIGURATION: 296 case TAG_USES_FEATURE: 297 case TAG_USES_LIBRARY: 298 case TAG_USES_NATIVE_LIBRARY: 299 case TAG_USES_PERMISSION: 300 case TAG_USES_PERMISSION_SDK_23: 301 case TAG_USES_PERMISSION_SDK_M: 302 case TAG_USES_SDK: 303 return true; 304 default: 305 return false; 306 } 307 } 308 init(String tag)309 private void init(String tag) { 310 this.mTag = tag; 311 mChildTagMask = 0; 312 mTotalComponentMetadataSize = 0; 313 switch (tag) { 314 case TAG_ACTIVITY: 315 initializeCounter(TAG_LAYOUT, 1000); 316 initializeCounter(TAG_META_DATA, 1000); 317 initializeCounter(TAG_INTENT_FILTER, 20000); 318 break; 319 case TAG_ACTIVITY_ALIAS: 320 case TAG_RECEIVER: 321 case TAG_SERVICE: 322 initializeCounter(TAG_META_DATA, 1000); 323 initializeCounter(TAG_INTENT_FILTER, 20000); 324 break; 325 case TAG_APPLICATION: 326 initializeCounter(TAG_PROFILEABLE, 100); 327 initializeCounter(TAG_USES_NATIVE_LIBRARY, 100); 328 initializeCounter(TAG_RECEIVER, 1000); 329 initializeCounter(TAG_SERVICE, 1000); 330 initializeCounter(TAG_META_DATA, 1000); 331 initializeCounter(TAG_USES_LIBRARY, 1000); 332 initializeCounter(TAG_ACTIVITY_ALIAS, 4000); 333 initializeCounter(TAG_PROVIDER, 8000); 334 initializeCounter(TAG_ACTIVITY, 30000); 335 break; 336 case TAG_COMPATIBLE_SCREENS: 337 initializeCounter(TAG_SCREEN, 4000); 338 break; 339 case TAG_INTENT: 340 case TAG_INTENT_FILTER: 341 initializeCounter(TAG_URI_RELATIVE_FILTER_GROUP, 100); 342 initializeCounter(TAG_ACTION, 20000); 343 initializeCounter(TAG_CATEGORY, 40000); 344 initializeCounter(TAG_DATA, 40000); 345 break; 346 case TAG_MANIFEST: 347 initializeCounter(TAG_APPLICATION, 100); 348 initializeCounter(TAG_OVERLAY, 100); 349 initializeCounter(TAG_INSTRUMENTATION, 100); 350 initializeCounter(TAG_PERMISSION_GROUP, 100); 351 initializeCounter(TAG_PERMISSION_TREE, 100); 352 initializeCounter(TAG_SUPPORTS_GL_TEXTURE, 100); 353 initializeCounter(TAG_SUPPORTS_SCREENS, 100); 354 initializeCounter(TAG_USES_CONFIGURATION, 100); 355 initializeCounter(TAG_USES_SDK, 100); 356 initializeCounter(TAG_COMPATIBLE_SCREENS, 200); 357 initializeCounter(TAG_QUERIES, 200); 358 initializeCounter(TAG_ATTRIBUTION, 400); 359 initializeCounter(TAG_USES_FEATURE, 400); 360 initializeCounter(TAG_PERMISSION, 2000); 361 initializeCounter(TAG_USES_PERMISSION, 20000); 362 break; 363 case TAG_PROVIDER: 364 initializeCounter(TAG_GRANT_URI_PERMISSION, 100); 365 initializeCounter(TAG_PATH_PERMISSION, 100); 366 initializeCounter(TAG_META_DATA, 1000); 367 initializeCounter(TAG_INTENT_FILTER, 20000); 368 break; 369 case TAG_QUERIES: 370 initializeCounter(TAG_PACKAGE, 1000); 371 initializeCounter(TAG_INTENT, 2000); 372 initializeCounter(TAG_PROVIDER, 8000); 373 break; 374 case TAG_URI_RELATIVE_FILTER_GROUP: 375 initializeCounter(TAG_DATA, 100); 376 break; 377 } 378 } 379 getAttrStrMaxLen(String attrName)380 private static int getAttrStrMaxLen(String attrName) { 381 switch (attrName) { 382 case TAG_ATTR_HOST: 383 case TAG_ATTR_PORT: 384 case TAG_ATTR_SCHEME: 385 return MAX_ATTR_LEN_URL_COMPONENT; 386 case TAG_ATTR_PERMISSION_GROUP: 387 return MAX_ATTR_LEN_PERMISSION_GROUP; 388 case TAG_ATTR_SHARED_USER_ID: 389 case TAG_ATTR_PACKAGE: 390 case TAG_ATTR_TARGET_PACKAGE: 391 return MAX_ATTR_LEN_PACKAGE; 392 case TAG_ATTR_MIMETYPE: 393 return MAX_ATTR_LEN_MIMETYPE; 394 case TAG_ATTR_BACKUP_AGENT: 395 case TAG_ATTR_CATEGORY: 396 case TAG_ATTR_MANAGE_SPACE_ACTIVITY: 397 case TAG_ATTR_MIMEGROUP: 398 case TAG_ATTR_NAME: 399 case TAG_ATTR_PARENT_ACTIVITY_NAME: 400 case TAG_ATTR_PERMISSION: 401 case TAG_ATTR_PROCESS: 402 case TAG_ATTR_READ_PERMISSION: 403 case TAG_ATTR_REQUIRED_ACCOUNT_TYPE: 404 case TAG_ATTR_REQUIRED_SYSTEM_PROPERTY_NAME: 405 case TAG_ATTR_RESTRICTED_ACCOUNT_TYPE: 406 case TAG_ATTR_TARGET_ACTIVITY: 407 case TAG_ATTR_TARGET_NAME: 408 case TAG_ATTR_TARGET_PROCESSES: 409 case TAG_ATTR_TASK_AFFINITY: 410 case TAG_ATTR_WRITE_PERMISSION: 411 case TAG_ATTR_VERSION_NAME: 412 case TAG_ATTR_ZYGOTE_PRELOAD_NAME: 413 return MAX_ATTR_LEN_NAME; 414 case TAG_ATTR_FRAGMENT: 415 case TAG_ATTR_FRAGMENT_ADVANCED_PATTERN: 416 case TAG_ATTR_FRAGMENT_PATTERN: 417 case TAG_ATTR_FRAGMENT_PREFIX: 418 case TAG_ATTR_FRAGMENT_SUFFIX: 419 case TAG_ATTR_PATH: 420 case TAG_ATTR_PATH_ADVANCED_PATTERN: 421 case TAG_ATTR_PATH_PATTERN: 422 case TAG_ATTR_PATH_PREFIX: 423 case TAG_ATTR_PATH_SUFFIX: 424 case TAG_ATTR_QUERY: 425 case TAG_ATTR_QUERY_ADVANCED_PATTERN: 426 case TAG_ATTR_QUERY_PATTERN: 427 case TAG_ATTR_QUERY_PREFIX: 428 case TAG_ATTR_QUERY_SUFFIX: 429 return MAX_ATTR_LEN_PATH; 430 case TAG_ATTR_VALUE: 431 return MAX_ATTR_LEN_VALUE; 432 case TAG_ATTR_REQUIRED_SYSTEM_PROPERTY_VALUE: 433 return PROP_VALUE_MAX; 434 default: 435 return DEFAULT_MAX_STRING_ATTR_LENGTH; 436 } 437 } 438 getResStrMaxLen(@tyleableRes int index)439 private int getResStrMaxLen(@StyleableRes int index) { 440 switch (mTag) { 441 case TAG_ACTION: 442 return getActionResStrMaxLen(index); 443 case TAG_ACTIVITY: 444 return getActivityResStrMaxLen(index); 445 case TAG_ACTIVITY_ALIAS: 446 return getActivityAliasResStrMaxLen(index); 447 case TAG_APPLICATION: 448 return getApplicationResStrMaxLen(index); 449 case TAG_DATA: 450 return getDataResStrMaxLen(index); 451 case TAG_CATEGORY: 452 return getCategoryResStrMaxLen(index); 453 case TAG_GRANT_URI_PERMISSION: 454 return getGrantUriPermissionResStrMaxLen(index); 455 case TAG_INSTRUMENTATION: 456 return getInstrumentationResStrMaxLen(index); 457 case TAG_MANIFEST: 458 return getManifestResStrMaxLen(index); 459 case TAG_META_DATA: 460 return getMetaDataResStrMaxLen(index); 461 case TAG_OVERLAY: 462 return getOverlayResStrMaxLen(index); 463 case TAG_PATH_PERMISSION: 464 return getPathPermissionResStrMaxLen(index); 465 case TAG_PERMISSION: 466 return getPermissionResStrMaxLen(index); 467 case TAG_PERMISSION_GROUP: 468 return getPermissionGroupResStrMaxLen(index); 469 case TAG_PERMISSION_TREE: 470 return getPermissionTreeResStrMaxLen(index); 471 case TAG_PROPERTY: 472 return getPropertyResStrMaxLen(index); 473 case TAG_PROVIDER: 474 return getProviderResStrMaxLen(index); 475 case TAG_RECEIVER: 476 return getReceiverResStrMaxLen(index); 477 case TAG_SERVICE: 478 return getServiceResStrMaxLen(index); 479 case TAG_USES_FEATURE: 480 return getUsesFeatureResStrMaxLen(index); 481 case TAG_USES_LIBRARY: 482 return getUsesLibraryResStrMaxLen(index); 483 case TAG_USES_NATIVE_LIBRARY: 484 return getUsesNativeLibraryResStrMaxLen(index); 485 case TAG_USES_PERMISSION: 486 case TAG_USES_PERMISSION_SDK_23: 487 case TAG_USES_PERMISSION_SDK_M: 488 return getUsesPermissionResStrMaxLen(index); 489 default: 490 return DEFAULT_MAX_STRING_ATTR_LENGTH; 491 } 492 } 493 getActionResStrMaxLen(@tyleableRes int index)494 private static int getActionResStrMaxLen(@StyleableRes int index) { 495 switch (index) { 496 case R.styleable.AndroidManifestAction_name: 497 return MAX_ATTR_LEN_NAME; 498 default: 499 return DEFAULT_MAX_STRING_ATTR_LENGTH; 500 } 501 } 502 getActivityResStrMaxLen(@tyleableRes int index)503 private static int getActivityResStrMaxLen(@StyleableRes int index) { 504 switch (index) { 505 case R.styleable.AndroidManifestActivity_name: 506 case R.styleable.AndroidManifestActivity_parentActivityName: 507 case R.styleable.AndroidManifestActivity_permission: 508 case R.styleable.AndroidManifestActivity_process: 509 case R.styleable.AndroidManifestActivity_taskAffinity: 510 return MAX_ATTR_LEN_NAME; 511 default: 512 return DEFAULT_MAX_STRING_ATTR_LENGTH; 513 } 514 } 515 getActivityAliasResStrMaxLen(@tyleableRes int index)516 private static int getActivityAliasResStrMaxLen(@StyleableRes int index) { 517 switch (index) { 518 case R.styleable.AndroidManifestActivityAlias_name: 519 case R.styleable.AndroidManifestActivityAlias_permission: 520 case R.styleable.AndroidManifestActivityAlias_targetActivity: 521 return MAX_ATTR_LEN_NAME; 522 default: 523 return DEFAULT_MAX_STRING_ATTR_LENGTH; 524 } 525 } 526 getApplicationResStrMaxLen(@tyleableRes int index)527 private static int getApplicationResStrMaxLen(@StyleableRes int index) { 528 switch (index) { 529 case R.styleable.AndroidManifestApplication_backupAgent: 530 case R.styleable.AndroidManifestApplication_manageSpaceActivity: 531 case R.styleable.AndroidManifestApplication_name: 532 case R.styleable.AndroidManifestApplication_permission: 533 case R.styleable.AndroidManifestApplication_process: 534 case R.styleable.AndroidManifestApplication_requiredAccountType: 535 case R.styleable.AndroidManifestApplication_restrictedAccountType: 536 case R.styleable.AndroidManifestApplication_taskAffinity: 537 case R.styleable.AndroidManifestApplication_zygotePreloadName: 538 return MAX_ATTR_LEN_NAME; 539 default: 540 return DEFAULT_MAX_STRING_ATTR_LENGTH; 541 } 542 } 543 getCategoryResStrMaxLen(@tyleableRes int index)544 private static int getCategoryResStrMaxLen(@StyleableRes int index) { 545 switch (index) { 546 case R.styleable.AndroidManifestCategory_name: 547 return MAX_ATTR_LEN_NAME; 548 default: 549 return DEFAULT_MAX_STRING_ATTR_LENGTH; 550 } 551 } 552 getDataResStrMaxLen(@tyleableRes int index)553 private static int getDataResStrMaxLen(@StyleableRes int index) { 554 switch (index) { 555 case R.styleable.AndroidManifestData_host: 556 case R.styleable.AndroidManifestData_port: 557 case R.styleable.AndroidManifestData_scheme: 558 return MAX_ATTR_LEN_URL_COMPONENT; 559 case R.styleable.AndroidManifestData_mimeType: 560 return MAX_ATTR_LEN_MIMETYPE; 561 case R.styleable.AndroidManifestData_mimeGroup: 562 return MAX_ATTR_LEN_NAME; 563 case R.styleable.AndroidManifestData_path: 564 case R.styleable.AndroidManifestData_pathPattern: 565 case R.styleable.AndroidManifestData_pathPrefix: 566 case R.styleable.AndroidManifestData_pathSuffix: 567 case R.styleable.AndroidManifestData_pathAdvancedPattern: 568 case R.styleable.AndroidManifestData_query: 569 case R.styleable.AndroidManifestData_queryPattern: 570 case R.styleable.AndroidManifestData_queryPrefix: 571 case R.styleable.AndroidManifestData_querySuffix: 572 case R.styleable.AndroidManifestData_queryAdvancedPattern: 573 case R.styleable.AndroidManifestData_fragment: 574 case R.styleable.AndroidManifestData_fragmentPattern: 575 case R.styleable.AndroidManifestData_fragmentPrefix: 576 case R.styleable.AndroidManifestData_fragmentSuffix: 577 case R.styleable.AndroidManifestData_fragmentAdvancedPattern: 578 return MAX_ATTR_LEN_PATH; 579 default: 580 return DEFAULT_MAX_STRING_ATTR_LENGTH; 581 } 582 } 583 getGrantUriPermissionResStrMaxLen(@tyleableRes int index)584 private static int getGrantUriPermissionResStrMaxLen(@StyleableRes int index) { 585 switch (index) { 586 case R.styleable.AndroidManifestGrantUriPermission_path: 587 case R.styleable.AndroidManifestGrantUriPermission_pathPattern: 588 case R.styleable.AndroidManifestGrantUriPermission_pathPrefix: 589 return MAX_ATTR_LEN_PATH; 590 default: 591 return DEFAULT_MAX_STRING_ATTR_LENGTH; 592 } 593 } 594 getInstrumentationResStrMaxLen(@tyleableRes int index)595 private static int getInstrumentationResStrMaxLen(@StyleableRes int index) { 596 switch (index) { 597 case R.styleable.AndroidManifestInstrumentation_targetPackage: 598 return MAX_ATTR_LEN_PACKAGE; 599 case R.styleable.AndroidManifestInstrumentation_name: 600 case R.styleable.AndroidManifestInstrumentation_targetProcesses: 601 return MAX_ATTR_LEN_NAME; 602 default: 603 return DEFAULT_MAX_STRING_ATTR_LENGTH; 604 } 605 } 606 getManifestResStrMaxLen(@tyleableRes int index)607 private static int getManifestResStrMaxLen(@StyleableRes int index) { 608 switch (index) { 609 case R.styleable.AndroidManifest_sharedUserId: 610 return MAX_ATTR_LEN_PACKAGE; 611 case R.styleable.AndroidManifest_versionName: 612 return MAX_ATTR_LEN_NAME; 613 default: 614 return DEFAULT_MAX_STRING_ATTR_LENGTH; 615 } 616 } 617 getMetaDataResStrMaxLen(@tyleableRes int index)618 private static int getMetaDataResStrMaxLen(@StyleableRes int index) { 619 switch (index) { 620 case R.styleable.AndroidManifestMetaData_name: 621 return MAX_ATTR_LEN_NAME; 622 case R.styleable.AndroidManifestMetaData_value: 623 return MAX_ATTR_LEN_VALUE; 624 default: 625 return DEFAULT_MAX_STRING_ATTR_LENGTH; 626 } 627 } 628 getOverlayResStrMaxLen(@tyleableRes int index)629 private static int getOverlayResStrMaxLen(@StyleableRes int index) { 630 switch (index) { 631 case R.styleable.AndroidManifestResourceOverlay_targetPackage: 632 return MAX_ATTR_LEN_PACKAGE; 633 case R.styleable.AndroidManifestResourceOverlay_category: 634 case R.styleable.AndroidManifestResourceOverlay_requiredSystemPropertyName: 635 case R.styleable.AndroidManifestResourceOverlay_targetName: 636 return MAX_ATTR_LEN_NAME; 637 case R.styleable.AndroidManifestResourceOverlay_requiredSystemPropertyValue: 638 return PROP_VALUE_MAX; 639 default: 640 return DEFAULT_MAX_STRING_ATTR_LENGTH; 641 } 642 } 643 getPathPermissionResStrMaxLen(@tyleableRes int index)644 private static int getPathPermissionResStrMaxLen(@StyleableRes int index) { 645 switch (index) { 646 case R.styleable.AndroidManifestPathPermission_permission: 647 case R.styleable.AndroidManifestPathPermission_readPermission: 648 case R.styleable.AndroidManifestPathPermission_writePermission: 649 return MAX_ATTR_LEN_NAME; 650 case R.styleable.AndroidManifestPathPermission_path: 651 case R.styleable.AndroidManifestPathPermission_pathPattern: 652 case R.styleable.AndroidManifestPathPermission_pathPrefix: 653 return MAX_ATTR_LEN_PATH; 654 default: 655 return DEFAULT_MAX_STRING_ATTR_LENGTH; 656 } 657 } 658 getPermissionResStrMaxLen(@tyleableRes int index)659 private static int getPermissionResStrMaxLen(@StyleableRes int index) { 660 switch (index) { 661 case R.styleable.AndroidManifestPermission_permissionGroup: 662 return MAX_ATTR_LEN_PERMISSION_GROUP; 663 case R.styleable.AndroidManifestPermission_name: 664 return MAX_ATTR_LEN_NAME; 665 default: 666 return DEFAULT_MAX_STRING_ATTR_LENGTH; 667 } 668 } 669 getPermissionGroupResStrMaxLen(@tyleableRes int index)670 private static int getPermissionGroupResStrMaxLen(@StyleableRes int index) { 671 switch (index) { 672 case R.styleable.AndroidManifestPermissionGroup_name: 673 return MAX_ATTR_LEN_NAME; 674 default: 675 return DEFAULT_MAX_STRING_ATTR_LENGTH; 676 } 677 } 678 getPermissionTreeResStrMaxLen(@tyleableRes int index)679 private static int getPermissionTreeResStrMaxLen(@StyleableRes int index) { 680 switch (index) { 681 case R.styleable.AndroidManifestPermissionTree_name: 682 return MAX_ATTR_LEN_NAME; 683 default: 684 return DEFAULT_MAX_STRING_ATTR_LENGTH; 685 } 686 } 687 getPropertyResStrMaxLen(@tyleableRes int index)688 private static int getPropertyResStrMaxLen(@StyleableRes int index) { 689 switch (index) { 690 case R.styleable.AndroidManifestProperty_name: 691 return MAX_ATTR_LEN_NAME; 692 case R.styleable.AndroidManifestProperty_value: 693 return MAX_ATTR_LEN_VALUE; 694 default: 695 return DEFAULT_MAX_STRING_ATTR_LENGTH; 696 } 697 } 698 getProviderResStrMaxLen(@tyleableRes int index)699 private static int getProviderResStrMaxLen(@StyleableRes int index) { 700 switch (index) { 701 case R.styleable.AndroidManifestProvider_name: 702 case R.styleable.AndroidManifestProvider_permission: 703 case R.styleable.AndroidManifestProvider_process: 704 case R.styleable.AndroidManifestProvider_readPermission: 705 case R.styleable.AndroidManifestProvider_writePermission: 706 return MAX_ATTR_LEN_NAME; 707 default: 708 return DEFAULT_MAX_STRING_ATTR_LENGTH; 709 } 710 } 711 getReceiverResStrMaxLen(@tyleableRes int index)712 private static int getReceiverResStrMaxLen(@StyleableRes int index) { 713 switch (index) { 714 case R.styleable.AndroidManifestReceiver_name: 715 case R.styleable.AndroidManifestReceiver_permission: 716 case R.styleable.AndroidManifestReceiver_process: 717 return MAX_ATTR_LEN_NAME; 718 default: 719 return DEFAULT_MAX_STRING_ATTR_LENGTH; 720 } 721 } 722 getServiceResStrMaxLen(@tyleableRes int index)723 private static int getServiceResStrMaxLen(@StyleableRes int index) { 724 switch (index) { 725 case R.styleable.AndroidManifestReceiver_name: 726 case R.styleable.AndroidManifestReceiver_permission: 727 case R.styleable.AndroidManifestReceiver_process: 728 return MAX_ATTR_LEN_NAME; 729 default: 730 return DEFAULT_MAX_STRING_ATTR_LENGTH; 731 } 732 } 733 getUsesFeatureResStrMaxLen(@tyleableRes int index)734 private static int getUsesFeatureResStrMaxLen(@StyleableRes int index) { 735 switch (index) { 736 case R.styleable.AndroidManifestUsesFeature_name: 737 return MAX_ATTR_LEN_NAME; 738 default: 739 return DEFAULT_MAX_STRING_ATTR_LENGTH; 740 } 741 } 742 getUsesLibraryResStrMaxLen(@tyleableRes int index)743 private static int getUsesLibraryResStrMaxLen(@StyleableRes int index) { 744 switch (index) { 745 case R.styleable.AndroidManifestUsesLibrary_name: 746 return MAX_ATTR_LEN_NAME; 747 default: 748 return DEFAULT_MAX_STRING_ATTR_LENGTH; 749 } 750 } 751 getUsesNativeLibraryResStrMaxLen(@tyleableRes int index)752 private static int getUsesNativeLibraryResStrMaxLen(@StyleableRes int index) { 753 switch (index) { 754 case R.styleable.AndroidManifestUsesNativeLibrary_name: 755 return MAX_ATTR_LEN_NAME; 756 default: 757 return DEFAULT_MAX_STRING_ATTR_LENGTH; 758 } 759 } 760 getUsesPermissionResStrMaxLen(@tyleableRes int index)761 private static int getUsesPermissionResStrMaxLen(@StyleableRes int index) { 762 switch (index) { 763 case R.styleable.AndroidManifestUsesPermission_name: 764 return MAX_ATTR_LEN_NAME; 765 default: 766 return DEFAULT_MAX_STRING_ATTR_LENGTH; 767 } 768 } 769 initializeCounter(String tag, int max)770 private void initializeCounter(String tag, int max) { 771 int idx = getCounterIdx(tag); 772 if (mTagCounters[idx] == null) { 773 mTagCounters[idx] = new TagCounter(); 774 } 775 mTagCounters[idx].reset(max); 776 mChildTagMask |= 1 << idx; 777 } 778 isComponentNameAttr(String name)779 private boolean isComponentNameAttr(String name) { 780 switch (mTag) { 781 case TAG_ACTIVITY: 782 switch (name) { 783 case TAG_ATTR_NAME: 784 case TAG_ATTR_PARENT_ACTIVITY_NAME: 785 return true; 786 default: 787 return false; 788 } 789 case TAG_ACTIVITY_ALIAS: 790 switch (name) { 791 case TAG_ATTR_TARGET_ACTIVITY: 792 return true; 793 default: 794 return false; 795 } 796 case TAG_APPLICATION: 797 switch (name) { 798 case TAG_ATTR_BACKUP_AGENT: 799 case TAG_ATTR_NAME: 800 case TAG_ATTR_ZYGOTE_PRELOAD_NAME: 801 return true; 802 default: 803 return false; 804 } 805 case TAG_INSTRUMENTATION: 806 case TAG_PROVIDER: 807 case TAG_RECEIVER: 808 case TAG_SERVICE: 809 switch (name) { 810 case TAG_ATTR_NAME: 811 return true; 812 default: 813 return false; 814 } 815 default: 816 return false; 817 } 818 } 819 isComponentNameAttr(@tyleableRes int index)820 private boolean isComponentNameAttr(@StyleableRes int index) { 821 switch (mTag) { 822 case TAG_ACTIVITY: 823 return index == R.styleable.AndroidManifestActivity_name 824 || index == R.styleable.AndroidManifestActivity_parentActivityName; 825 case TAG_ACTIVITY_ALIAS: 826 return index == R.styleable.AndroidManifestActivityAlias_targetActivity; 827 case TAG_APPLICATION: 828 return index == R.styleable.AndroidManifestApplication_backupAgent 829 || index == R.styleable.AndroidManifestApplication_name 830 || index == R.styleable.AndroidManifestApplication_zygotePreloadName; 831 case TAG_INSTRUMENTATION: 832 return index == R.styleable.AndroidManifestInstrumentation_name; 833 case TAG_PROVIDER: 834 return index == R.styleable.AndroidManifestProvider_name; 835 case TAG_RECEIVER: 836 return index == R.styleable.AndroidManifestReceiver_name; 837 case TAG_SERVICE: 838 return index == R.styleable.AndroidManifestService_name; 839 default: 840 return false; 841 } 842 } 843 hasChild(String tag)844 boolean hasChild(String tag) { 845 return (mChildTagMask & (1 << getCounterIdx(tag))) != 0; 846 } 847 validateComponentName(CharSequence name)848 void validateComponentName(CharSequence name) { 849 boolean isStart = true; 850 for (int i = 0; i < name.length(); i++) { 851 if (BAD_COMPONENT_NAME_CHARS.indexOf(name.charAt(i)) >= 0) { 852 Slog.e(TAG, name + " is not a valid Java class name"); 853 throw new SecurityException(name + " is not a valid Java class name"); 854 } 855 } 856 } 857 validateStrAttr(String attrName, String attrValue)858 void validateStrAttr(String attrName, String attrValue) { 859 if (attrValue != null && attrValue.length() > getAttrStrMaxLen(attrName)) { 860 throw new SecurityException("String length limit exceeded for attribute " + attrName 861 + " in " + mTag); 862 } 863 if (isComponentNameAttr(attrName)) { 864 validateComponentName(attrValue); 865 } 866 } 867 validateResStrAttr(@tyleableRes int index, CharSequence stringValue)868 void validateResStrAttr(@StyleableRes int index, CharSequence stringValue) { 869 if (stringValue != null && stringValue.length() > getResStrMaxLen(index)) { 870 throw new SecurityException("String length limit exceeded for attribute in " + mTag); 871 } 872 if (isComponentNameAttr(index)) { 873 validateComponentName(stringValue); 874 } 875 } 876 validateComponentMetadata(String value)877 void validateComponentMetadata(String value) { 878 mTotalComponentMetadataSize += value.length(); 879 if (mTotalComponentMetadataSize > MAX_TOTAL_META_DATA_SIZE) { 880 throw new SecurityException("Max total meta data size limit exceeded for " + mTag); 881 } 882 } 883 seen(@onNull Element element)884 void seen(@NonNull Element element) { 885 TagCounter counter = mTagCounters[getCounterIdx(element.mTag)]; 886 if (counter != null) { 887 counter.increment(); 888 if (!counter.isValid()) { 889 throw new SecurityException("The number of child " + element.mTag 890 + " elements exceeded the max allowed in " + this.mTag); 891 } 892 } 893 } 894 } 895