1 /* 2 * Copyright (C) 2023 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 package android.content.res; 18 19 import static android.os.SystemProperties.PROP_VALUE_MAX; 20 21 import android.annotation.NonNull; 22 import android.util.Pools.SimplePool; 23 import android.util.Slog; 24 25 import androidx.annotation.StyleableRes; 26 27 import com.android.internal.R; 28 29 import java.util.Set; 30 31 /** 32 * Defines the string attribute length and child tag count restrictions for a xml element. 33 * 34 * {@hide} 35 */ 36 public class Element { 37 private static final int DEFAULT_MAX_STRING_ATTR_LENGTH = 32_768; 38 private static final int MAX_POOL_SIZE = 128; 39 private static final int MAX_ATTR_LEN_URL_COMPONENT = 256; 40 private static final int MAX_ATTR_LEN_PERMISSION_GROUP = 256; 41 private static final int MAX_ATTR_LEN_PACKAGE = 256; 42 /** 43 * The mime type max length restriction here should match the restriction that is also 44 * placed in {@link android.content.pm.PackageManager#setMimeGroup(String, Set)} 45 */ 46 private static final int MAX_ATTR_LEN_MIMETYPE = 255; 47 private static final int MAX_ATTR_LEN_NAME = 1024; 48 private static final int MAX_ATTR_LEN_PATH = 4000; 49 private static final int MAX_ATTR_LEN_VALUE = 32_768; 50 51 private static final int MAX_TOTAL_META_DATA_SIZE = 262_144; 52 53 private static final String BAD_COMPONENT_NAME_CHARS = ";,[](){}:?%^*|/\\"; 54 55 private static final String TAG = "PackageParsing"; 56 protected static final String TAG_ACTION = "action"; 57 protected static final String TAG_ACTIVITY = "activity"; 58 protected static final String TAG_ADOPT_PERMISSIONS = "adopt-permissions"; 59 protected static final String TAG_ACTIVITY_ALIAS = "activity-alias"; 60 protected static final String TAG_APPLICATION = "application"; 61 protected static final String TAG_ATTRIBUTION = "attribution"; 62 protected static final String TAG_CATEGORY = "category"; 63 protected static final String TAG_COMPATIBLE_SCREENS = "compatible-screens"; 64 protected static final String TAG_DATA = "data"; 65 protected static final String TAG_EAT_COMMENT = "eat-comment"; 66 protected static final String TAG_FEATURE_GROUP = "feature-group"; 67 protected static final String TAG_GRANT_URI_PERMISSION = "grant-uri-permission"; 68 protected static final String TAG_INSTRUMENTATION = "instrumentation"; 69 protected static final String TAG_INTENT = "intent"; 70 protected static final String TAG_INTENT_FILTER = "intent-filter"; 71 protected static final String TAG_KEY_SETS = "key-sets"; 72 protected static final String TAG_LAYOUT = "layout"; 73 protected static final String TAG_MANIFEST = "manifest"; 74 protected static final String TAG_META_DATA = "meta-data"; 75 protected static final String TAG_ORIGINAL_PACKAGE = "original-package"; 76 protected static final String TAG_OVERLAY = "overlay"; 77 protected static final String TAG_PACKAGE = "package"; 78 protected static final String TAG_PACKAGE_VERIFIER = "package-verifier"; 79 protected static final String TAG_PATH_PERMISSION = "path-permission"; 80 protected static final String TAG_PERMISSION = "permission"; 81 protected static final String TAG_PERMISSION_GROUP = "permission-group"; 82 protected static final String TAG_PERMISSION_TREE = "permission-tree"; 83 protected static final String TAG_PROFILEABLE = "profileable"; 84 protected static final String TAG_PROTECTED_BROADCAST = "protected-broadcast"; 85 protected static final String TAG_PROPERTY = "property"; 86 protected static final String TAG_PROVIDER = "provider"; 87 protected static final String TAG_QUERIES = "queries"; 88 protected static final String TAG_RECEIVER = "receiver"; 89 protected static final String TAG_RESTRICT_UPDATE = "restrict-update"; 90 protected static final String TAG_SCREEN = "screen"; 91 protected static final String TAG_SERVICE = "service"; 92 protected static final String TAG_SUPPORT_SCREENS = "supports-screens"; 93 protected static final String TAG_SUPPORTS_GL_TEXTURE = "supports-gl-texture"; 94 protected static final String TAG_SUPPORTS_INPUT = "supports-input"; 95 protected static final String TAG_SUPPORTS_SCREENS = "supports-screens"; 96 protected static final String TAG_URI_RELATIVE_FILTER_GROUP = "uri-relative-filter-group"; 97 protected static final String TAG_USES_CONFIGURATION = "uses-configuration"; 98 protected static final String TAG_USES_FEATURE = "uses-feature"; 99 protected static final String TAG_USES_GL_TEXTURE = "uses-gl-texture"; 100 protected static final String TAG_USES_LIBRARY = "uses-library"; 101 protected static final String TAG_USES_NATIVE_LIBRARY = "uses-native-library"; 102 protected static final String TAG_USES_PERMISSION = "uses-permission"; 103 protected static final String TAG_USES_PERMISSION_SDK_23 = "uses-permission-sdk-23"; 104 protected static final String TAG_USES_PERMISSION_SDK_M = "uses-permission-sdk-m"; 105 protected static final String TAG_USES_SDK = "uses-sdk"; 106 protected static final String TAG_USES_SPLIT = "uses-split"; 107 108 protected static final String TAG_ATTR_BACKUP_AGENT = "backupAgent"; 109 protected static final String TAG_ATTR_CATEGORY = "category"; 110 protected static final String TAG_ATTR_FRAGMENT = "fragment"; 111 protected static final String TAG_ATTR_FRAGMENT_ADVANCED_PATTERN = "fragmentAdvancedPattern"; 112 protected static final String TAG_ATTR_FRAGMENT_PATTERN = "fragmentPattern"; 113 protected static final String TAG_ATTR_FRAGMENT_PREFIX = "fragmentPrefix"; 114 protected static final String TAG_ATTR_FRAGMENT_SUFFIX = "fragmentSuffix"; 115 protected static final String TAG_ATTR_HOST = "host"; 116 protected static final String TAG_ATTR_MANAGE_SPACE_ACTIVITY = "manageSpaceActivity"; 117 protected static final String TAG_ATTR_MIMETYPE = "mimeType"; 118 protected static final String TAG_ATTR_MIMEGROUP = "mimeGroup"; 119 protected static final String TAG_ATTR_NAME = "name"; 120 protected static final String TAG_ATTR_PACKAGE = "package"; 121 protected static final String TAG_ATTR_PATH = "path"; 122 protected static final String TAG_ATTR_PATH_ADVANCED_PATTERN = "pathAdvancedPattern"; 123 protected static final String TAG_ATTR_PATH_PATTERN = "pathPattern"; 124 protected static final String TAG_ATTR_PATH_PREFIX = "pathPrefix"; 125 protected static final String TAG_ATTR_PATH_SUFFIX = "pathSuffix"; 126 protected static final String TAG_ATTR_PARENT_ACTIVITY_NAME = "parentActivityName"; 127 protected static final String TAG_ATTR_PERMISSION = "permission"; 128 protected static final String TAG_ATTR_PERMISSION_GROUP = "permissionGroup"; 129 protected static final String TAG_ATTR_PORT = "port"; 130 protected static final String TAG_ATTR_PROCESS = "process"; 131 protected static final String TAG_ATTR_QUERY = "query"; 132 protected static final String TAG_ATTR_QUERY_ADVANCED_PATTERN = "queryAdvancedPattern"; 133 protected static final String TAG_ATTR_QUERY_PATTERN = "queryPattern"; 134 protected static final String TAG_ATTR_QUERY_PREFIX = "queryPrefix"; 135 protected static final String TAG_ATTR_QUERY_SUFFIX = "querySuffix"; 136 protected static final String TAG_ATTR_READ_PERMISSION = "readPermission"; 137 protected static final String TAG_ATTR_REQUIRED_ACCOUNT_TYPE = "requiredAccountType"; 138 protected static final String TAG_ATTR_REQUIRED_SYSTEM_PROPERTY_NAME = 139 "requiredSystemPropertyName"; 140 protected static final String TAG_ATTR_REQUIRED_SYSTEM_PROPERTY_VALUE = 141 "requiredSystemPropertyValue"; 142 protected static final String TAG_ATTR_RESTRICTED_ACCOUNT_TYPE = "restrictedAccountType"; 143 protected static final String TAG_ATTR_SCHEME = "scheme"; 144 protected static final String TAG_ATTR_SHARED_USER_ID = "sharedUserId"; 145 protected static final String TAG_ATTR_TARGET_ACTIVITY = "targetActivity"; 146 protected static final String TAG_ATTR_TARGET_NAME = "targetName"; 147 protected static final String TAG_ATTR_TARGET_PACKAGE = "targetPackage"; 148 protected static final String TAG_ATTR_TARGET_PROCESSES = "targetProcesses"; 149 protected static final String TAG_ATTR_TASK_AFFINITY = "taskAffinity"; 150 protected static final String TAG_ATTR_VALUE = "value"; 151 protected static final String TAG_ATTR_VERSION_NAME = "versionName"; 152 protected static final String TAG_ATTR_WRITE_PERMISSION = "writePermission"; 153 protected static final String TAG_ATTR_ZYGOTE_PRELOAD_NAME = "zygotePreloadName"; 154 155 // The length of mTagCounters corresponds to the number of tags defined in getCounterIdx. If new 156 // tags are added then the size here should be increased to match. 157 private final TagCounter[] mTagCounters = new TagCounter[35]; 158 159 String mTag; 160 161 private static final ThreadLocal<SimplePool<Element>> sPool = 162 ThreadLocal.withInitial(() -> new SimplePool<>(MAX_POOL_SIZE)); 163 164 @NonNull obtain(@onNull String tag)165 static Element obtain(@NonNull String tag) { 166 Element element = sPool.get().acquire(); 167 if (element == null) { 168 element = new Element(); 169 } 170 element.init(tag); 171 return element; 172 } 173 recycle()174 void recycle() { 175 mTag = null; 176 sPool.get().release(this); 177 } 178 179 private long mChildTagMask = 0; 180 private int mTotalComponentMetadataSize = 0; 181 getCounterIdx(String tag)182 private static int getCounterIdx(String tag) { 183 switch(tag) { 184 case TAG_LAYOUT: 185 return 0; 186 case TAG_META_DATA: 187 return 1; 188 case TAG_INTENT_FILTER: 189 return 2; 190 case TAG_PROFILEABLE: 191 return 3; 192 case TAG_USES_NATIVE_LIBRARY: 193 return 4; 194 case TAG_RECEIVER: 195 return 5; 196 case TAG_SERVICE: 197 return 6; 198 case TAG_ACTIVITY_ALIAS: 199 return 7; 200 case TAG_USES_LIBRARY: 201 return 8; 202 case TAG_PROVIDER: 203 return 9; 204 case TAG_ACTIVITY: 205 return 10; 206 case TAG_ACTION: 207 return 11; 208 case TAG_CATEGORY: 209 return 12; 210 case TAG_DATA: 211 return 13; 212 case TAG_APPLICATION: 213 return 14; 214 case TAG_OVERLAY: 215 return 15; 216 case TAG_INSTRUMENTATION: 217 return 16; 218 case TAG_PERMISSION_GROUP: 219 return 17; 220 case TAG_PERMISSION_TREE: 221 return 18; 222 case TAG_SUPPORTS_GL_TEXTURE: 223 return 19; 224 case TAG_SUPPORTS_SCREENS: 225 return 20; 226 case TAG_USES_CONFIGURATION: 227 return 21; 228 case TAG_USES_SDK: 229 return 22; 230 case TAG_COMPATIBLE_SCREENS: 231 return 23; 232 case TAG_QUERIES: 233 return 24; 234 case TAG_ATTRIBUTION: 235 return 25; 236 case TAG_USES_FEATURE: 237 return 26; 238 case TAG_PERMISSION: 239 return 27; 240 case TAG_USES_PERMISSION: 241 case TAG_USES_PERMISSION_SDK_23: 242 case TAG_USES_PERMISSION_SDK_M: 243 return 28; 244 case TAG_GRANT_URI_PERMISSION: 245 return 29; 246 case TAG_PATH_PERMISSION: 247 return 30; 248 case TAG_PACKAGE: 249 return 31; 250 case TAG_INTENT: 251 return 32; 252 case TAG_URI_RELATIVE_FILTER_GROUP: 253 return 33; 254 default: 255 // The size of the mTagCounters array should be equal to this value+1 256 return 34; 257 } 258 } 259 shouldValidate(String tag)260 static boolean shouldValidate(String tag) { 261 switch (tag) { 262 case TAG_ACTION: 263 case TAG_ACTIVITY: 264 case TAG_ACTIVITY_ALIAS: 265 case TAG_APPLICATION: 266 case TAG_ATTRIBUTION: 267 case TAG_CATEGORY: 268 case TAG_COMPATIBLE_SCREENS: 269 case TAG_DATA: 270 case TAG_GRANT_URI_PERMISSION: 271 case TAG_INSTRUMENTATION: 272 case TAG_INTENT: 273 case TAG_INTENT_FILTER: 274 case TAG_LAYOUT: 275 case TAG_MANIFEST: 276 case TAG_META_DATA: 277 case TAG_OVERLAY: 278 case TAG_PACKAGE: 279 case TAG_PATH_PERMISSION: 280 case TAG_PERMISSION: 281 case TAG_PERMISSION_GROUP: 282 case TAG_PERMISSION_TREE: 283 case TAG_PROFILEABLE: 284 case TAG_PROPERTY: 285 case TAG_PROVIDER: 286 case TAG_QUERIES: 287 case TAG_RECEIVER: 288 case TAG_SCREEN: 289 case TAG_SERVICE: 290 case TAG_SUPPORTS_GL_TEXTURE: 291 case TAG_SUPPORTS_SCREENS: 292 case TAG_URI_RELATIVE_FILTER_GROUP: 293 case TAG_USES_CONFIGURATION: 294 case TAG_USES_FEATURE: 295 case TAG_USES_LIBRARY: 296 case TAG_USES_NATIVE_LIBRARY: 297 case TAG_USES_PERMISSION: 298 case TAG_USES_PERMISSION_SDK_23: 299 case TAG_USES_PERMISSION_SDK_M: 300 case TAG_USES_SDK: 301 return true; 302 default: 303 return false; 304 } 305 } 306 init(String tag)307 private void init(String tag) { 308 this.mTag = tag; 309 mChildTagMask = 0; 310 mTotalComponentMetadataSize = 0; 311 switch (tag) { 312 case TAG_ACTIVITY: 313 initializeCounter(TAG_LAYOUT, 1000); 314 initializeCounter(TAG_META_DATA, 1000); 315 initializeCounter(TAG_INTENT_FILTER, 20000); 316 break; 317 case TAG_ACTIVITY_ALIAS: 318 case TAG_RECEIVER: 319 case TAG_SERVICE: 320 initializeCounter(TAG_META_DATA, 1000); 321 initializeCounter(TAG_INTENT_FILTER, 20000); 322 break; 323 case TAG_APPLICATION: 324 initializeCounter(TAG_PROFILEABLE, 100); 325 initializeCounter(TAG_USES_NATIVE_LIBRARY, 100); 326 initializeCounter(TAG_RECEIVER, 1000); 327 initializeCounter(TAG_SERVICE, 1000); 328 initializeCounter(TAG_META_DATA, 1000); 329 initializeCounter(TAG_USES_LIBRARY, 1000); 330 initializeCounter(TAG_ACTIVITY_ALIAS, 4000); 331 initializeCounter(TAG_PROVIDER, 8000); 332 initializeCounter(TAG_ACTIVITY, 30000); 333 break; 334 case TAG_COMPATIBLE_SCREENS: 335 initializeCounter(TAG_SCREEN, 4000); 336 break; 337 case TAG_INTENT: 338 case TAG_INTENT_FILTER: 339 initializeCounter(TAG_URI_RELATIVE_FILTER_GROUP, 100); 340 initializeCounter(TAG_ACTION, 20000); 341 initializeCounter(TAG_CATEGORY, 40000); 342 initializeCounter(TAG_DATA, 40000); 343 break; 344 case TAG_MANIFEST: 345 initializeCounter(TAG_APPLICATION, 100); 346 initializeCounter(TAG_OVERLAY, 100); 347 initializeCounter(TAG_INSTRUMENTATION, 100); 348 initializeCounter(TAG_PERMISSION_GROUP, 100); 349 initializeCounter(TAG_PERMISSION_TREE, 100); 350 initializeCounter(TAG_SUPPORTS_GL_TEXTURE, 100); 351 initializeCounter(TAG_SUPPORTS_SCREENS, 100); 352 initializeCounter(TAG_USES_CONFIGURATION, 100); 353 initializeCounter(TAG_USES_SDK, 100); 354 initializeCounter(TAG_COMPATIBLE_SCREENS, 200); 355 initializeCounter(TAG_QUERIES, 200); 356 initializeCounter(TAG_ATTRIBUTION, 400); 357 initializeCounter(TAG_USES_FEATURE, 400); 358 initializeCounter(TAG_PERMISSION, 2000); 359 initializeCounter(TAG_USES_PERMISSION, 20000); 360 break; 361 case TAG_PROVIDER: 362 initializeCounter(TAG_GRANT_URI_PERMISSION, 100); 363 initializeCounter(TAG_PATH_PERMISSION, 100); 364 initializeCounter(TAG_META_DATA, 1000); 365 initializeCounter(TAG_INTENT_FILTER, 20000); 366 break; 367 case TAG_QUERIES: 368 initializeCounter(TAG_PACKAGE, 1000); 369 initializeCounter(TAG_INTENT, 2000); 370 initializeCounter(TAG_PROVIDER, 8000); 371 break; 372 case TAG_URI_RELATIVE_FILTER_GROUP: 373 initializeCounter(TAG_DATA, 100); 374 break; 375 } 376 } 377 getAttrStrMaxLen(String attrName)378 private static int getAttrStrMaxLen(String attrName) { 379 switch (attrName) { 380 case TAG_ATTR_HOST: 381 case TAG_ATTR_PORT: 382 case TAG_ATTR_SCHEME: 383 return MAX_ATTR_LEN_URL_COMPONENT; 384 case TAG_ATTR_PERMISSION_GROUP: 385 return MAX_ATTR_LEN_PERMISSION_GROUP; 386 case TAG_ATTR_SHARED_USER_ID: 387 case TAG_ATTR_PACKAGE: 388 case TAG_ATTR_TARGET_PACKAGE: 389 return MAX_ATTR_LEN_PACKAGE; 390 case TAG_ATTR_MIMETYPE: 391 return MAX_ATTR_LEN_MIMETYPE; 392 case TAG_ATTR_BACKUP_AGENT: 393 case TAG_ATTR_CATEGORY: 394 case TAG_ATTR_MANAGE_SPACE_ACTIVITY: 395 case TAG_ATTR_MIMEGROUP: 396 case TAG_ATTR_NAME: 397 case TAG_ATTR_PARENT_ACTIVITY_NAME: 398 case TAG_ATTR_PERMISSION: 399 case TAG_ATTR_PROCESS: 400 case TAG_ATTR_READ_PERMISSION: 401 case TAG_ATTR_REQUIRED_ACCOUNT_TYPE: 402 case TAG_ATTR_REQUIRED_SYSTEM_PROPERTY_NAME: 403 case TAG_ATTR_RESTRICTED_ACCOUNT_TYPE: 404 case TAG_ATTR_TARGET_ACTIVITY: 405 case TAG_ATTR_TARGET_NAME: 406 case TAG_ATTR_TARGET_PROCESSES: 407 case TAG_ATTR_TASK_AFFINITY: 408 case TAG_ATTR_WRITE_PERMISSION: 409 case TAG_ATTR_VERSION_NAME: 410 case TAG_ATTR_ZYGOTE_PRELOAD_NAME: 411 return MAX_ATTR_LEN_NAME; 412 case TAG_ATTR_FRAGMENT: 413 case TAG_ATTR_FRAGMENT_ADVANCED_PATTERN: 414 case TAG_ATTR_FRAGMENT_PATTERN: 415 case TAG_ATTR_FRAGMENT_PREFIX: 416 case TAG_ATTR_FRAGMENT_SUFFIX: 417 case TAG_ATTR_PATH: 418 case TAG_ATTR_PATH_ADVANCED_PATTERN: 419 case TAG_ATTR_PATH_PATTERN: 420 case TAG_ATTR_PATH_PREFIX: 421 case TAG_ATTR_PATH_SUFFIX: 422 case TAG_ATTR_QUERY: 423 case TAG_ATTR_QUERY_ADVANCED_PATTERN: 424 case TAG_ATTR_QUERY_PATTERN: 425 case TAG_ATTR_QUERY_PREFIX: 426 case TAG_ATTR_QUERY_SUFFIX: 427 return MAX_ATTR_LEN_PATH; 428 case TAG_ATTR_VALUE: 429 return MAX_ATTR_LEN_VALUE; 430 case TAG_ATTR_REQUIRED_SYSTEM_PROPERTY_VALUE: 431 return PROP_VALUE_MAX; 432 default: 433 return DEFAULT_MAX_STRING_ATTR_LENGTH; 434 } 435 } 436 getResStrMaxLen(@tyleableRes int index)437 private int getResStrMaxLen(@StyleableRes int index) { 438 switch (mTag) { 439 case TAG_ACTION: 440 return getActionResStrMaxLen(index); 441 case TAG_ACTIVITY: 442 return getActivityResStrMaxLen(index); 443 case TAG_ACTIVITY_ALIAS: 444 return getActivityAliasResStrMaxLen(index); 445 case TAG_APPLICATION: 446 return getApplicationResStrMaxLen(index); 447 case TAG_DATA: 448 return getDataResStrMaxLen(index); 449 case TAG_CATEGORY: 450 return getCategoryResStrMaxLen(index); 451 case TAG_GRANT_URI_PERMISSION: 452 return getGrantUriPermissionResStrMaxLen(index); 453 case TAG_INSTRUMENTATION: 454 return getInstrumentationResStrMaxLen(index); 455 case TAG_MANIFEST: 456 return getManifestResStrMaxLen(index); 457 case TAG_META_DATA: 458 return getMetaDataResStrMaxLen(index); 459 case TAG_OVERLAY: 460 return getOverlayResStrMaxLen(index); 461 case TAG_PATH_PERMISSION: 462 return getPathPermissionResStrMaxLen(index); 463 case TAG_PERMISSION: 464 return getPermissionResStrMaxLen(index); 465 case TAG_PERMISSION_GROUP: 466 return getPermissionGroupResStrMaxLen(index); 467 case TAG_PERMISSION_TREE: 468 return getPermissionTreeResStrMaxLen(index); 469 case TAG_PROPERTY: 470 return getPropertyResStrMaxLen(index); 471 case TAG_PROVIDER: 472 return getProviderResStrMaxLen(index); 473 case TAG_RECEIVER: 474 return getReceiverResStrMaxLen(index); 475 case TAG_SERVICE: 476 return getServiceResStrMaxLen(index); 477 case TAG_USES_FEATURE: 478 return getUsesFeatureResStrMaxLen(index); 479 case TAG_USES_LIBRARY: 480 return getUsesLibraryResStrMaxLen(index); 481 case TAG_USES_NATIVE_LIBRARY: 482 return getUsesNativeLibraryResStrMaxLen(index); 483 case TAG_USES_PERMISSION: 484 case TAG_USES_PERMISSION_SDK_23: 485 case TAG_USES_PERMISSION_SDK_M: 486 return getUsesPermissionResStrMaxLen(index); 487 default: 488 return DEFAULT_MAX_STRING_ATTR_LENGTH; 489 } 490 } 491 getActionResStrMaxLen(@tyleableRes int index)492 private static int getActionResStrMaxLen(@StyleableRes int index) { 493 switch (index) { 494 case R.styleable.AndroidManifestAction_name: 495 return MAX_ATTR_LEN_NAME; 496 default: 497 return DEFAULT_MAX_STRING_ATTR_LENGTH; 498 } 499 } 500 getActivityResStrMaxLen(@tyleableRes int index)501 private static int getActivityResStrMaxLen(@StyleableRes int index) { 502 switch (index) { 503 case R.styleable.AndroidManifestActivity_name: 504 case R.styleable.AndroidManifestActivity_parentActivityName: 505 case R.styleable.AndroidManifestActivity_permission: 506 case R.styleable.AndroidManifestActivity_process: 507 case R.styleable.AndroidManifestActivity_taskAffinity: 508 return MAX_ATTR_LEN_NAME; 509 default: 510 return DEFAULT_MAX_STRING_ATTR_LENGTH; 511 } 512 } 513 getActivityAliasResStrMaxLen(@tyleableRes int index)514 private static int getActivityAliasResStrMaxLen(@StyleableRes int index) { 515 switch (index) { 516 case R.styleable.AndroidManifestActivityAlias_name: 517 case R.styleable.AndroidManifestActivityAlias_permission: 518 case R.styleable.AndroidManifestActivityAlias_targetActivity: 519 return MAX_ATTR_LEN_NAME; 520 default: 521 return DEFAULT_MAX_STRING_ATTR_LENGTH; 522 } 523 } 524 getApplicationResStrMaxLen(@tyleableRes int index)525 private static int getApplicationResStrMaxLen(@StyleableRes int index) { 526 switch (index) { 527 case R.styleable.AndroidManifestApplication_backupAgent: 528 case R.styleable.AndroidManifestApplication_manageSpaceActivity: 529 case R.styleable.AndroidManifestApplication_name: 530 case R.styleable.AndroidManifestApplication_permission: 531 case R.styleable.AndroidManifestApplication_process: 532 case R.styleable.AndroidManifestApplication_requiredAccountType: 533 case R.styleable.AndroidManifestApplication_restrictedAccountType: 534 case R.styleable.AndroidManifestApplication_taskAffinity: 535 case R.styleable.AndroidManifestApplication_zygotePreloadName: 536 return MAX_ATTR_LEN_NAME; 537 default: 538 return DEFAULT_MAX_STRING_ATTR_LENGTH; 539 } 540 } 541 getCategoryResStrMaxLen(@tyleableRes int index)542 private static int getCategoryResStrMaxLen(@StyleableRes int index) { 543 switch (index) { 544 case R.styleable.AndroidManifestCategory_name: 545 return MAX_ATTR_LEN_NAME; 546 default: 547 return DEFAULT_MAX_STRING_ATTR_LENGTH; 548 } 549 } 550 getDataResStrMaxLen(@tyleableRes int index)551 private static int getDataResStrMaxLen(@StyleableRes int index) { 552 switch (index) { 553 case R.styleable.AndroidManifestData_host: 554 case R.styleable.AndroidManifestData_port: 555 case R.styleable.AndroidManifestData_scheme: 556 return MAX_ATTR_LEN_URL_COMPONENT; 557 case R.styleable.AndroidManifestData_mimeType: 558 return MAX_ATTR_LEN_MIMETYPE; 559 case R.styleable.AndroidManifestData_mimeGroup: 560 return MAX_ATTR_LEN_NAME; 561 case R.styleable.AndroidManifestData_path: 562 case R.styleable.AndroidManifestData_pathPattern: 563 case R.styleable.AndroidManifestData_pathPrefix: 564 case R.styleable.AndroidManifestData_pathSuffix: 565 case R.styleable.AndroidManifestData_pathAdvancedPattern: 566 case R.styleable.AndroidManifestData_query: 567 case R.styleable.AndroidManifestData_queryPattern: 568 case R.styleable.AndroidManifestData_queryPrefix: 569 case R.styleable.AndroidManifestData_querySuffix: 570 case R.styleable.AndroidManifestData_queryAdvancedPattern: 571 case R.styleable.AndroidManifestData_fragment: 572 case R.styleable.AndroidManifestData_fragmentPattern: 573 case R.styleable.AndroidManifestData_fragmentPrefix: 574 case R.styleable.AndroidManifestData_fragmentSuffix: 575 case R.styleable.AndroidManifestData_fragmentAdvancedPattern: 576 return MAX_ATTR_LEN_PATH; 577 default: 578 return DEFAULT_MAX_STRING_ATTR_LENGTH; 579 } 580 } 581 getGrantUriPermissionResStrMaxLen(@tyleableRes int index)582 private static int getGrantUriPermissionResStrMaxLen(@StyleableRes int index) { 583 switch (index) { 584 case R.styleable.AndroidManifestGrantUriPermission_path: 585 case R.styleable.AndroidManifestGrantUriPermission_pathPattern: 586 case R.styleable.AndroidManifestGrantUriPermission_pathPrefix: 587 return MAX_ATTR_LEN_PATH; 588 default: 589 return DEFAULT_MAX_STRING_ATTR_LENGTH; 590 } 591 } 592 getInstrumentationResStrMaxLen(@tyleableRes int index)593 private static int getInstrumentationResStrMaxLen(@StyleableRes int index) { 594 switch (index) { 595 case R.styleable.AndroidManifestInstrumentation_targetPackage: 596 return MAX_ATTR_LEN_PACKAGE; 597 case R.styleable.AndroidManifestInstrumentation_name: 598 case R.styleable.AndroidManifestInstrumentation_targetProcesses: 599 return MAX_ATTR_LEN_NAME; 600 default: 601 return DEFAULT_MAX_STRING_ATTR_LENGTH; 602 } 603 } 604 getManifestResStrMaxLen(@tyleableRes int index)605 private static int getManifestResStrMaxLen(@StyleableRes int index) { 606 switch (index) { 607 case R.styleable.AndroidManifest_sharedUserId: 608 return MAX_ATTR_LEN_PACKAGE; 609 case R.styleable.AndroidManifest_versionName: 610 return MAX_ATTR_LEN_NAME; 611 default: 612 return DEFAULT_MAX_STRING_ATTR_LENGTH; 613 } 614 } 615 getMetaDataResStrMaxLen(@tyleableRes int index)616 private static int getMetaDataResStrMaxLen(@StyleableRes int index) { 617 switch (index) { 618 case R.styleable.AndroidManifestMetaData_name: 619 return MAX_ATTR_LEN_NAME; 620 case R.styleable.AndroidManifestMetaData_value: 621 return MAX_ATTR_LEN_VALUE; 622 default: 623 return DEFAULT_MAX_STRING_ATTR_LENGTH; 624 } 625 } 626 getOverlayResStrMaxLen(@tyleableRes int index)627 private static int getOverlayResStrMaxLen(@StyleableRes int index) { 628 switch (index) { 629 case R.styleable.AndroidManifestResourceOverlay_targetPackage: 630 return MAX_ATTR_LEN_PACKAGE; 631 case R.styleable.AndroidManifestResourceOverlay_category: 632 case R.styleable.AndroidManifestResourceOverlay_requiredSystemPropertyName: 633 case R.styleable.AndroidManifestResourceOverlay_targetName: 634 return MAX_ATTR_LEN_NAME; 635 case R.styleable.AndroidManifestResourceOverlay_requiredSystemPropertyValue: 636 return PROP_VALUE_MAX; 637 default: 638 return DEFAULT_MAX_STRING_ATTR_LENGTH; 639 } 640 } 641 getPathPermissionResStrMaxLen(@tyleableRes int index)642 private static int getPathPermissionResStrMaxLen(@StyleableRes int index) { 643 switch (index) { 644 case R.styleable.AndroidManifestPathPermission_permission: 645 case R.styleable.AndroidManifestPathPermission_readPermission: 646 case R.styleable.AndroidManifestPathPermission_writePermission: 647 return MAX_ATTR_LEN_NAME; 648 case R.styleable.AndroidManifestPathPermission_path: 649 case R.styleable.AndroidManifestPathPermission_pathPattern: 650 case R.styleable.AndroidManifestPathPermission_pathPrefix: 651 return MAX_ATTR_LEN_PATH; 652 default: 653 return DEFAULT_MAX_STRING_ATTR_LENGTH; 654 } 655 } 656 getPermissionResStrMaxLen(@tyleableRes int index)657 private static int getPermissionResStrMaxLen(@StyleableRes int index) { 658 switch (index) { 659 case R.styleable.AndroidManifestPermission_permissionGroup: 660 return MAX_ATTR_LEN_PERMISSION_GROUP; 661 case R.styleable.AndroidManifestPermission_name: 662 return MAX_ATTR_LEN_NAME; 663 default: 664 return DEFAULT_MAX_STRING_ATTR_LENGTH; 665 } 666 } 667 getPermissionGroupResStrMaxLen(@tyleableRes int index)668 private static int getPermissionGroupResStrMaxLen(@StyleableRes int index) { 669 switch (index) { 670 case R.styleable.AndroidManifestPermissionGroup_name: 671 return MAX_ATTR_LEN_NAME; 672 default: 673 return DEFAULT_MAX_STRING_ATTR_LENGTH; 674 } 675 } 676 getPermissionTreeResStrMaxLen(@tyleableRes int index)677 private static int getPermissionTreeResStrMaxLen(@StyleableRes int index) { 678 switch (index) { 679 case R.styleable.AndroidManifestPermissionTree_name: 680 return MAX_ATTR_LEN_NAME; 681 default: 682 return DEFAULT_MAX_STRING_ATTR_LENGTH; 683 } 684 } 685 getPropertyResStrMaxLen(@tyleableRes int index)686 private static int getPropertyResStrMaxLen(@StyleableRes int index) { 687 switch (index) { 688 case R.styleable.AndroidManifestProperty_name: 689 return MAX_ATTR_LEN_NAME; 690 case R.styleable.AndroidManifestProperty_value: 691 return MAX_ATTR_LEN_VALUE; 692 default: 693 return DEFAULT_MAX_STRING_ATTR_LENGTH; 694 } 695 } 696 getProviderResStrMaxLen(@tyleableRes int index)697 private static int getProviderResStrMaxLen(@StyleableRes int index) { 698 switch (index) { 699 case R.styleable.AndroidManifestProvider_name: 700 case R.styleable.AndroidManifestProvider_permission: 701 case R.styleable.AndroidManifestProvider_process: 702 case R.styleable.AndroidManifestProvider_readPermission: 703 case R.styleable.AndroidManifestProvider_writePermission: 704 return MAX_ATTR_LEN_NAME; 705 default: 706 return DEFAULT_MAX_STRING_ATTR_LENGTH; 707 } 708 } 709 getReceiverResStrMaxLen(@tyleableRes int index)710 private static int getReceiverResStrMaxLen(@StyleableRes int index) { 711 switch (index) { 712 case R.styleable.AndroidManifestReceiver_name: 713 case R.styleable.AndroidManifestReceiver_permission: 714 case R.styleable.AndroidManifestReceiver_process: 715 return MAX_ATTR_LEN_NAME; 716 default: 717 return DEFAULT_MAX_STRING_ATTR_LENGTH; 718 } 719 } 720 getServiceResStrMaxLen(@tyleableRes int index)721 private static int getServiceResStrMaxLen(@StyleableRes int index) { 722 switch (index) { 723 case R.styleable.AndroidManifestReceiver_name: 724 case R.styleable.AndroidManifestReceiver_permission: 725 case R.styleable.AndroidManifestReceiver_process: 726 return MAX_ATTR_LEN_NAME; 727 default: 728 return DEFAULT_MAX_STRING_ATTR_LENGTH; 729 } 730 } 731 getUsesFeatureResStrMaxLen(@tyleableRes int index)732 private static int getUsesFeatureResStrMaxLen(@StyleableRes int index) { 733 switch (index) { 734 case R.styleable.AndroidManifestUsesFeature_name: 735 return MAX_ATTR_LEN_NAME; 736 default: 737 return DEFAULT_MAX_STRING_ATTR_LENGTH; 738 } 739 } 740 getUsesLibraryResStrMaxLen(@tyleableRes int index)741 private static int getUsesLibraryResStrMaxLen(@StyleableRes int index) { 742 switch (index) { 743 case R.styleable.AndroidManifestUsesLibrary_name: 744 return MAX_ATTR_LEN_NAME; 745 default: 746 return DEFAULT_MAX_STRING_ATTR_LENGTH; 747 } 748 } 749 getUsesNativeLibraryResStrMaxLen(@tyleableRes int index)750 private static int getUsesNativeLibraryResStrMaxLen(@StyleableRes int index) { 751 switch (index) { 752 case R.styleable.AndroidManifestUsesNativeLibrary_name: 753 return MAX_ATTR_LEN_NAME; 754 default: 755 return DEFAULT_MAX_STRING_ATTR_LENGTH; 756 } 757 } 758 getUsesPermissionResStrMaxLen(@tyleableRes int index)759 private static int getUsesPermissionResStrMaxLen(@StyleableRes int index) { 760 switch (index) { 761 case R.styleable.AndroidManifestUsesPermission_name: 762 return MAX_ATTR_LEN_NAME; 763 default: 764 return DEFAULT_MAX_STRING_ATTR_LENGTH; 765 } 766 } 767 initializeCounter(String tag, int max)768 private void initializeCounter(String tag, int max) { 769 int idx = getCounterIdx(tag); 770 if (mTagCounters[idx] == null) { 771 mTagCounters[idx] = new TagCounter(); 772 } 773 mTagCounters[idx].reset(max); 774 mChildTagMask |= 1 << idx; 775 } 776 isComponentNameAttr(String name)777 private boolean isComponentNameAttr(String name) { 778 switch (mTag) { 779 case TAG_ACTIVITY: 780 switch (name) { 781 case TAG_ATTR_NAME: 782 case TAG_ATTR_PARENT_ACTIVITY_NAME: 783 return true; 784 default: 785 return false; 786 } 787 case TAG_ACTIVITY_ALIAS: 788 switch (name) { 789 case TAG_ATTR_TARGET_ACTIVITY: 790 return true; 791 default: 792 return false; 793 } 794 case TAG_APPLICATION: 795 switch (name) { 796 case TAG_ATTR_BACKUP_AGENT: 797 case TAG_ATTR_NAME: 798 case TAG_ATTR_ZYGOTE_PRELOAD_NAME: 799 return true; 800 default: 801 return false; 802 } 803 case TAG_INSTRUMENTATION: 804 case TAG_PROVIDER: 805 case TAG_RECEIVER: 806 case TAG_SERVICE: 807 switch (name) { 808 case TAG_ATTR_NAME: 809 return true; 810 default: 811 return false; 812 } 813 default: 814 return false; 815 } 816 } 817 isComponentNameAttr(@tyleableRes int index)818 private boolean isComponentNameAttr(@StyleableRes int index) { 819 switch (mTag) { 820 case TAG_ACTIVITY: 821 return index == R.styleable.AndroidManifestActivity_name 822 || index == R.styleable.AndroidManifestActivity_parentActivityName; 823 case TAG_ACTIVITY_ALIAS: 824 return index == R.styleable.AndroidManifestActivityAlias_targetActivity; 825 case TAG_APPLICATION: 826 return index == R.styleable.AndroidManifestApplication_backupAgent 827 || index == R.styleable.AndroidManifestApplication_name 828 || index == R.styleable.AndroidManifestApplication_zygotePreloadName; 829 case TAG_INSTRUMENTATION: 830 return index == R.styleable.AndroidManifestInstrumentation_name; 831 case TAG_PROVIDER: 832 return index == R.styleable.AndroidManifestProvider_name; 833 case TAG_RECEIVER: 834 return index == R.styleable.AndroidManifestReceiver_name; 835 case TAG_SERVICE: 836 return index == R.styleable.AndroidManifestService_name; 837 default: 838 return false; 839 } 840 } 841 hasChild(String tag)842 boolean hasChild(String tag) { 843 return (mChildTagMask & (1 << getCounterIdx(tag))) != 0; 844 } 845 validateComponentName(CharSequence name)846 void validateComponentName(CharSequence name) { 847 boolean isStart = true; 848 for (int i = 0; i < name.length(); i++) { 849 if (BAD_COMPONENT_NAME_CHARS.indexOf(name.charAt(i)) >= 0) { 850 Slog.e(TAG, name + " is not a valid Java class name"); 851 throw new SecurityException(name + " is not a valid Java class name"); 852 } 853 } 854 } 855 validateStrAttr(String attrName, String attrValue)856 void validateStrAttr(String attrName, String attrValue) { 857 if (attrValue != null && attrValue.length() > getAttrStrMaxLen(attrName)) { 858 throw new SecurityException("String length limit exceeded for attribute " + attrName 859 + " in " + mTag); 860 } 861 if (isComponentNameAttr(attrName)) { 862 validateComponentName(attrValue); 863 } 864 } 865 validateResStrAttr(@tyleableRes int index, CharSequence stringValue)866 void validateResStrAttr(@StyleableRes int index, CharSequence stringValue) { 867 if (stringValue != null && stringValue.length() > getResStrMaxLen(index)) { 868 throw new SecurityException("String length limit exceeded for attribute in " + mTag); 869 } 870 if (isComponentNameAttr(index)) { 871 validateComponentName(stringValue); 872 } 873 } 874 validateComponentMetadata(String value)875 void validateComponentMetadata(String value) { 876 mTotalComponentMetadataSize += value.length(); 877 if (mTotalComponentMetadataSize > MAX_TOTAL_META_DATA_SIZE) { 878 throw new SecurityException("Max total meta data size limit exceeded for " + mTag); 879 } 880 } 881 seen(@onNull Element element)882 void seen(@NonNull Element element) { 883 TagCounter counter = mTagCounters[getCounterIdx(element.mTag)]; 884 if (counter != null) { 885 counter.increment(); 886 if (!counter.isValid()) { 887 throw new SecurityException("The number of child " + element.mTag 888 + " elements exceeded the max allowed in " + this.mTag); 889 } 890 } 891 } 892 } 893