1 /*
2  * Copyright (C) 2023 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 package android.content.res;
18 
19 import static android.os.SystemProperties.PROP_VALUE_MAX;
20 
21 import android.annotation.NonNull;
22 import android.util.Pools.SimplePool;
23 import android.util.Slog;
24 
25 import androidx.annotation.StyleableRes;
26 
27 import com.android.internal.R;
28 
29 import java.util.Set;
30 
31 /**
32  * Defines the string attribute length and child tag count restrictions for a xml element.
33  *
34  * {@hide}
35  */
36 public class Element {
37     private static final int DEFAULT_MAX_STRING_ATTR_LENGTH = 32_768;
38     private static final int MAX_POOL_SIZE = 128;
39     private static final int MAX_ATTR_LEN_URL_COMPONENT = 256;
40     private static final int MAX_ATTR_LEN_PERMISSION_GROUP = 256;
41     private static final int MAX_ATTR_LEN_PACKAGE = 256;
42     /**
43      * The mime type max length restriction here should match the restriction that is also
44      * placed in {@link android.content.pm.PackageManager#setMimeGroup(String, Set)}
45      */
46     private static final int MAX_ATTR_LEN_MIMETYPE = 255;
47     private static final int MAX_ATTR_LEN_NAME = 1024;
48     private static final int MAX_ATTR_LEN_PATH = 4000;
49     private static final int MAX_ATTR_LEN_VALUE = 32_768;
50 
51     private static final int MAX_TOTAL_META_DATA_SIZE = 262_144;
52 
53     private static final String BAD_COMPONENT_NAME_CHARS = ";,[](){}:?%^*|/\\";
54 
55     private static final String TAG = "PackageParsing";
56     protected static final String TAG_ACTION = "action";
57     protected static final String TAG_ACTIVITY = "activity";
58     protected static final String TAG_ADOPT_PERMISSIONS = "adopt-permissions";
59     protected static final String TAG_ACTIVITY_ALIAS = "activity-alias";
60     protected static final String TAG_APPLICATION = "application";
61     protected static final String TAG_ATTRIBUTION = "attribution";
62     protected static final String TAG_CATEGORY = "category";
63     protected static final String TAG_COMPATIBLE_SCREENS = "compatible-screens";
64     protected static final String TAG_DATA = "data";
65     protected static final String TAG_EAT_COMMENT = "eat-comment";
66     protected static final String TAG_FEATURE_GROUP = "feature-group";
67     protected static final String TAG_GRANT_URI_PERMISSION = "grant-uri-permission";
68     protected static final String TAG_INSTRUMENTATION = "instrumentation";
69     protected static final String TAG_INTENT = "intent";
70     protected static final String TAG_INTENT_FILTER = "intent-filter";
71     protected static final String TAG_KEY_SETS = "key-sets";
72     protected static final String TAG_LAYOUT = "layout";
73     protected static final String TAG_MANIFEST = "manifest";
74     protected static final String TAG_META_DATA = "meta-data";
75     protected static final String TAG_ORIGINAL_PACKAGE = "original-package";
76     protected static final String TAG_OVERLAY = "overlay";
77     protected static final String TAG_PACKAGE = "package";
78     protected static final String TAG_PACKAGE_VERIFIER = "package-verifier";
79     protected static final String TAG_PATH_PERMISSION = "path-permission";
80     protected static final String TAG_PERMISSION = "permission";
81     protected static final String TAG_PERMISSION_GROUP = "permission-group";
82     protected static final String TAG_PERMISSION_TREE = "permission-tree";
83     protected static final String TAG_PROFILEABLE = "profileable";
84     protected static final String TAG_PROTECTED_BROADCAST = "protected-broadcast";
85     protected static final String TAG_PROPERTY = "property";
86     protected static final String TAG_PROVIDER = "provider";
87     protected static final String TAG_QUERIES = "queries";
88     protected static final String TAG_RECEIVER = "receiver";
89     protected static final String TAG_RESTRICT_UPDATE = "restrict-update";
90     protected static final String TAG_SCREEN = "screen";
91     protected static final String TAG_SERVICE = "service";
92     protected static final String TAG_SUPPORT_SCREENS = "supports-screens";
93     protected static final String TAG_SUPPORTS_GL_TEXTURE = "supports-gl-texture";
94     protected static final String TAG_SUPPORTS_INPUT = "supports-input";
95     protected static final String TAG_SUPPORTS_SCREENS = "supports-screens";
96     protected static final String TAG_URI_RELATIVE_FILTER_GROUP = "uri-relative-filter-group";
97     protected static final String TAG_USES_CONFIGURATION = "uses-configuration";
98     protected static final String TAG_USES_FEATURE = "uses-feature";
99     protected static final String TAG_USES_GL_TEXTURE = "uses-gl-texture";
100     protected static final String TAG_USES_LIBRARY = "uses-library";
101     protected static final String TAG_USES_NATIVE_LIBRARY = "uses-native-library";
102     protected static final String TAG_USES_PERMISSION = "uses-permission";
103     protected static final String TAG_USES_PERMISSION_SDK_23 = "uses-permission-sdk-23";
104     protected static final String TAG_USES_PERMISSION_SDK_M = "uses-permission-sdk-m";
105     protected static final String TAG_USES_SDK = "uses-sdk";
106     protected static final String TAG_USES_SPLIT = "uses-split";
107 
108     protected static final String TAG_ATTR_BACKUP_AGENT = "backupAgent";
109     protected static final String TAG_ATTR_CATEGORY = "category";
110     protected static final String TAG_ATTR_FRAGMENT = "fragment";
111     protected static final String TAG_ATTR_FRAGMENT_ADVANCED_PATTERN = "fragmentAdvancedPattern";
112     protected static final String TAG_ATTR_FRAGMENT_PATTERN = "fragmentPattern";
113     protected static final String TAG_ATTR_FRAGMENT_PREFIX = "fragmentPrefix";
114     protected static final String TAG_ATTR_FRAGMENT_SUFFIX = "fragmentSuffix";
115     protected static final String TAG_ATTR_HOST = "host";
116     protected static final String TAG_ATTR_MANAGE_SPACE_ACTIVITY = "manageSpaceActivity";
117     protected static final String TAG_ATTR_MIMETYPE = "mimeType";
118     protected static final String TAG_ATTR_MIMEGROUP = "mimeGroup";
119     protected static final String TAG_ATTR_NAME = "name";
120     protected static final String TAG_ATTR_PACKAGE = "package";
121     protected static final String TAG_ATTR_PATH = "path";
122     protected static final String TAG_ATTR_PATH_ADVANCED_PATTERN = "pathAdvancedPattern";
123     protected static final String TAG_ATTR_PATH_PATTERN = "pathPattern";
124     protected static final String TAG_ATTR_PATH_PREFIX = "pathPrefix";
125     protected static final String TAG_ATTR_PATH_SUFFIX = "pathSuffix";
126     protected static final String TAG_ATTR_PARENT_ACTIVITY_NAME = "parentActivityName";
127     protected static final String TAG_ATTR_PERMISSION = "permission";
128     protected static final String TAG_ATTR_PERMISSION_GROUP = "permissionGroup";
129     protected static final String TAG_ATTR_PORT = "port";
130     protected static final String TAG_ATTR_PROCESS = "process";
131     protected static final String TAG_ATTR_QUERY = "query";
132     protected static final String TAG_ATTR_QUERY_ADVANCED_PATTERN = "queryAdvancedPattern";
133     protected static final String TAG_ATTR_QUERY_PATTERN = "queryPattern";
134     protected static final String TAG_ATTR_QUERY_PREFIX = "queryPrefix";
135     protected static final String TAG_ATTR_QUERY_SUFFIX = "querySuffix";
136     protected static final String TAG_ATTR_READ_PERMISSION = "readPermission";
137     protected static final String TAG_ATTR_REQUIRED_ACCOUNT_TYPE = "requiredAccountType";
138     protected static final String TAG_ATTR_REQUIRED_SYSTEM_PROPERTY_NAME =
139             "requiredSystemPropertyName";
140     protected static final String TAG_ATTR_REQUIRED_SYSTEM_PROPERTY_VALUE =
141             "requiredSystemPropertyValue";
142     protected static final String TAG_ATTR_RESTRICTED_ACCOUNT_TYPE = "restrictedAccountType";
143     protected static final String TAG_ATTR_SCHEME = "scheme";
144     protected static final String TAG_ATTR_SHARED_USER_ID = "sharedUserId";
145     protected static final String TAG_ATTR_TARGET_ACTIVITY = "targetActivity";
146     protected static final String TAG_ATTR_TARGET_NAME = "targetName";
147     protected static final String TAG_ATTR_TARGET_PACKAGE = "targetPackage";
148     protected static final String TAG_ATTR_TARGET_PROCESSES = "targetProcesses";
149     protected static final String TAG_ATTR_TASK_AFFINITY = "taskAffinity";
150     protected static final String TAG_ATTR_VALUE = "value";
151     protected static final String TAG_ATTR_VERSION_NAME = "versionName";
152     protected static final String TAG_ATTR_WRITE_PERMISSION = "writePermission";
153     protected static final String TAG_ATTR_ZYGOTE_PRELOAD_NAME = "zygotePreloadName";
154 
155     // The length of mTagCounters corresponds to the number of tags defined in getCounterIdx. If new
156     // tags are added then the size here should be increased to match.
157     private final TagCounter[] mTagCounters = new TagCounter[35];
158 
159     String mTag;
160 
161     private static final ThreadLocal<SimplePool<Element>> sPool =
162             ThreadLocal.withInitial(() -> new SimplePool<>(MAX_POOL_SIZE));
163 
164     @NonNull
obtain(@onNull String tag)165     static Element obtain(@NonNull String tag) {
166         Element element = sPool.get().acquire();
167         if (element == null) {
168             element = new Element();
169         }
170         element.init(tag);
171         return element;
172     }
173 
recycle()174     void recycle() {
175         mTag = null;
176         sPool.get().release(this);
177     }
178 
179     private long mChildTagMask = 0;
180     private int mTotalComponentMetadataSize = 0;
181 
getCounterIdx(String tag)182     private static int getCounterIdx(String tag) {
183         switch(tag) {
184             case TAG_LAYOUT:
185                 return 0;
186             case TAG_META_DATA:
187                 return 1;
188             case TAG_INTENT_FILTER:
189                 return 2;
190             case TAG_PROFILEABLE:
191                 return 3;
192             case TAG_USES_NATIVE_LIBRARY:
193                 return 4;
194             case TAG_RECEIVER:
195                 return 5;
196             case TAG_SERVICE:
197                 return 6;
198             case TAG_ACTIVITY_ALIAS:
199                 return 7;
200             case TAG_USES_LIBRARY:
201                 return 8;
202             case TAG_PROVIDER:
203                 return 9;
204             case TAG_ACTIVITY:
205                 return 10;
206             case TAG_ACTION:
207                 return 11;
208             case TAG_CATEGORY:
209                 return 12;
210             case TAG_DATA:
211                 return 13;
212             case TAG_APPLICATION:
213                 return 14;
214             case TAG_OVERLAY:
215                 return 15;
216             case TAG_INSTRUMENTATION:
217                 return 16;
218             case TAG_PERMISSION_GROUP:
219                 return 17;
220             case TAG_PERMISSION_TREE:
221                 return 18;
222             case TAG_SUPPORTS_GL_TEXTURE:
223                 return 19;
224             case TAG_SUPPORTS_SCREENS:
225                 return 20;
226             case TAG_USES_CONFIGURATION:
227                 return 21;
228             case TAG_USES_SDK:
229                 return 22;
230             case TAG_COMPATIBLE_SCREENS:
231                 return 23;
232             case TAG_QUERIES:
233                 return 24;
234             case TAG_ATTRIBUTION:
235                 return 25;
236             case TAG_USES_FEATURE:
237                 return 26;
238             case TAG_PERMISSION:
239                 return 27;
240             case TAG_USES_PERMISSION:
241             case TAG_USES_PERMISSION_SDK_23:
242             case TAG_USES_PERMISSION_SDK_M:
243                 return 28;
244             case TAG_GRANT_URI_PERMISSION:
245                 return 29;
246             case TAG_PATH_PERMISSION:
247                 return 30;
248             case TAG_PACKAGE:
249                 return 31;
250             case TAG_INTENT:
251                 return 32;
252             case TAG_URI_RELATIVE_FILTER_GROUP:
253                 return 33;
254             default:
255                 // The size of the mTagCounters array should be equal to this value+1
256                 return 34;
257         }
258     }
259 
shouldValidate(String tag)260     static boolean shouldValidate(String tag) {
261         switch (tag) {
262             case TAG_ACTION:
263             case TAG_ACTIVITY:
264             case TAG_ACTIVITY_ALIAS:
265             case TAG_APPLICATION:
266             case TAG_ATTRIBUTION:
267             case TAG_CATEGORY:
268             case TAG_COMPATIBLE_SCREENS:
269             case TAG_DATA:
270             case TAG_GRANT_URI_PERMISSION:
271             case TAG_INSTRUMENTATION:
272             case TAG_INTENT:
273             case TAG_INTENT_FILTER:
274             case TAG_LAYOUT:
275             case TAG_MANIFEST:
276             case TAG_META_DATA:
277             case TAG_OVERLAY:
278             case TAG_PACKAGE:
279             case TAG_PATH_PERMISSION:
280             case TAG_PERMISSION:
281             case TAG_PERMISSION_GROUP:
282             case TAG_PERMISSION_TREE:
283             case TAG_PROFILEABLE:
284             case TAG_PROPERTY:
285             case TAG_PROVIDER:
286             case TAG_QUERIES:
287             case TAG_RECEIVER:
288             case TAG_SCREEN:
289             case TAG_SERVICE:
290             case TAG_SUPPORTS_GL_TEXTURE:
291             case TAG_SUPPORTS_SCREENS:
292             case TAG_URI_RELATIVE_FILTER_GROUP:
293             case TAG_USES_CONFIGURATION:
294             case TAG_USES_FEATURE:
295             case TAG_USES_LIBRARY:
296             case TAG_USES_NATIVE_LIBRARY:
297             case TAG_USES_PERMISSION:
298             case TAG_USES_PERMISSION_SDK_23:
299             case TAG_USES_PERMISSION_SDK_M:
300             case TAG_USES_SDK:
301                 return true;
302             default:
303                 return false;
304         }
305     }
306 
init(String tag)307     private void init(String tag) {
308         this.mTag = tag;
309         mChildTagMask = 0;
310         mTotalComponentMetadataSize = 0;
311         switch (tag) {
312             case TAG_ACTIVITY:
313                 initializeCounter(TAG_LAYOUT, 1000);
314                 initializeCounter(TAG_META_DATA, 1000);
315                 initializeCounter(TAG_INTENT_FILTER, 20000);
316                 break;
317             case TAG_ACTIVITY_ALIAS:
318             case TAG_RECEIVER:
319             case TAG_SERVICE:
320                 initializeCounter(TAG_META_DATA, 1000);
321                 initializeCounter(TAG_INTENT_FILTER, 20000);
322                 break;
323             case TAG_APPLICATION:
324                 initializeCounter(TAG_PROFILEABLE, 100);
325                 initializeCounter(TAG_USES_NATIVE_LIBRARY, 100);
326                 initializeCounter(TAG_RECEIVER, 1000);
327                 initializeCounter(TAG_SERVICE, 1000);
328                 initializeCounter(TAG_META_DATA, 1000);
329                 initializeCounter(TAG_USES_LIBRARY, 1000);
330                 initializeCounter(TAG_ACTIVITY_ALIAS, 4000);
331                 initializeCounter(TAG_PROVIDER, 8000);
332                 initializeCounter(TAG_ACTIVITY, 30000);
333                 break;
334             case TAG_COMPATIBLE_SCREENS:
335                 initializeCounter(TAG_SCREEN, 4000);
336                 break;
337             case TAG_INTENT:
338             case TAG_INTENT_FILTER:
339                 initializeCounter(TAG_URI_RELATIVE_FILTER_GROUP, 100);
340                 initializeCounter(TAG_ACTION, 20000);
341                 initializeCounter(TAG_CATEGORY, 40000);
342                 initializeCounter(TAG_DATA, 40000);
343                 break;
344             case TAG_MANIFEST:
345                 initializeCounter(TAG_APPLICATION, 100);
346                 initializeCounter(TAG_OVERLAY, 100);
347                 initializeCounter(TAG_INSTRUMENTATION, 100);
348                 initializeCounter(TAG_PERMISSION_GROUP, 100);
349                 initializeCounter(TAG_PERMISSION_TREE, 100);
350                 initializeCounter(TAG_SUPPORTS_GL_TEXTURE, 100);
351                 initializeCounter(TAG_SUPPORTS_SCREENS, 100);
352                 initializeCounter(TAG_USES_CONFIGURATION, 100);
353                 initializeCounter(TAG_USES_SDK, 100);
354                 initializeCounter(TAG_COMPATIBLE_SCREENS, 200);
355                 initializeCounter(TAG_QUERIES, 200);
356                 initializeCounter(TAG_ATTRIBUTION, 400);
357                 initializeCounter(TAG_USES_FEATURE, 400);
358                 initializeCounter(TAG_PERMISSION, 2000);
359                 initializeCounter(TAG_USES_PERMISSION, 20000);
360                 break;
361             case TAG_PROVIDER:
362                 initializeCounter(TAG_GRANT_URI_PERMISSION, 100);
363                 initializeCounter(TAG_PATH_PERMISSION, 100);
364                 initializeCounter(TAG_META_DATA, 1000);
365                 initializeCounter(TAG_INTENT_FILTER, 20000);
366                 break;
367             case TAG_QUERIES:
368                 initializeCounter(TAG_PACKAGE, 1000);
369                 initializeCounter(TAG_INTENT, 2000);
370                 initializeCounter(TAG_PROVIDER, 8000);
371                 break;
372             case TAG_URI_RELATIVE_FILTER_GROUP:
373                 initializeCounter(TAG_DATA, 100);
374                 break;
375         }
376     }
377 
getAttrStrMaxLen(String attrName)378     private static int getAttrStrMaxLen(String attrName) {
379         switch (attrName) {
380             case TAG_ATTR_HOST:
381             case TAG_ATTR_PORT:
382             case TAG_ATTR_SCHEME:
383                 return MAX_ATTR_LEN_URL_COMPONENT;
384             case TAG_ATTR_PERMISSION_GROUP:
385                 return MAX_ATTR_LEN_PERMISSION_GROUP;
386             case TAG_ATTR_SHARED_USER_ID:
387             case TAG_ATTR_PACKAGE:
388             case TAG_ATTR_TARGET_PACKAGE:
389                 return MAX_ATTR_LEN_PACKAGE;
390             case TAG_ATTR_MIMETYPE:
391                 return MAX_ATTR_LEN_MIMETYPE;
392             case TAG_ATTR_BACKUP_AGENT:
393             case TAG_ATTR_CATEGORY:
394             case TAG_ATTR_MANAGE_SPACE_ACTIVITY:
395             case TAG_ATTR_MIMEGROUP:
396             case TAG_ATTR_NAME:
397             case TAG_ATTR_PARENT_ACTIVITY_NAME:
398             case TAG_ATTR_PERMISSION:
399             case TAG_ATTR_PROCESS:
400             case TAG_ATTR_READ_PERMISSION:
401             case TAG_ATTR_REQUIRED_ACCOUNT_TYPE:
402             case TAG_ATTR_REQUIRED_SYSTEM_PROPERTY_NAME:
403             case TAG_ATTR_RESTRICTED_ACCOUNT_TYPE:
404             case TAG_ATTR_TARGET_ACTIVITY:
405             case TAG_ATTR_TARGET_NAME:
406             case TAG_ATTR_TARGET_PROCESSES:
407             case TAG_ATTR_TASK_AFFINITY:
408             case TAG_ATTR_WRITE_PERMISSION:
409             case TAG_ATTR_VERSION_NAME:
410             case TAG_ATTR_ZYGOTE_PRELOAD_NAME:
411                 return MAX_ATTR_LEN_NAME;
412             case TAG_ATTR_FRAGMENT:
413             case TAG_ATTR_FRAGMENT_ADVANCED_PATTERN:
414             case TAG_ATTR_FRAGMENT_PATTERN:
415             case TAG_ATTR_FRAGMENT_PREFIX:
416             case TAG_ATTR_FRAGMENT_SUFFIX:
417             case TAG_ATTR_PATH:
418             case TAG_ATTR_PATH_ADVANCED_PATTERN:
419             case TAG_ATTR_PATH_PATTERN:
420             case TAG_ATTR_PATH_PREFIX:
421             case TAG_ATTR_PATH_SUFFIX:
422             case TAG_ATTR_QUERY:
423             case TAG_ATTR_QUERY_ADVANCED_PATTERN:
424             case TAG_ATTR_QUERY_PATTERN:
425             case TAG_ATTR_QUERY_PREFIX:
426             case TAG_ATTR_QUERY_SUFFIX:
427                 return MAX_ATTR_LEN_PATH;
428             case TAG_ATTR_VALUE:
429                 return MAX_ATTR_LEN_VALUE;
430             case TAG_ATTR_REQUIRED_SYSTEM_PROPERTY_VALUE:
431                 return PROP_VALUE_MAX;
432             default:
433                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
434         }
435     }
436 
getResStrMaxLen(@tyleableRes int index)437     private int getResStrMaxLen(@StyleableRes int index) {
438         switch (mTag) {
439             case TAG_ACTION:
440                 return getActionResStrMaxLen(index);
441             case TAG_ACTIVITY:
442                 return getActivityResStrMaxLen(index);
443             case TAG_ACTIVITY_ALIAS:
444                 return getActivityAliasResStrMaxLen(index);
445             case TAG_APPLICATION:
446                 return getApplicationResStrMaxLen(index);
447             case TAG_DATA:
448                 return getDataResStrMaxLen(index);
449             case TAG_CATEGORY:
450                 return getCategoryResStrMaxLen(index);
451             case TAG_GRANT_URI_PERMISSION:
452                 return getGrantUriPermissionResStrMaxLen(index);
453             case TAG_INSTRUMENTATION:
454                 return getInstrumentationResStrMaxLen(index);
455             case TAG_MANIFEST:
456                 return getManifestResStrMaxLen(index);
457             case TAG_META_DATA:
458                 return getMetaDataResStrMaxLen(index);
459             case TAG_OVERLAY:
460                 return getOverlayResStrMaxLen(index);
461             case TAG_PATH_PERMISSION:
462                 return getPathPermissionResStrMaxLen(index);
463             case TAG_PERMISSION:
464                 return getPermissionResStrMaxLen(index);
465             case TAG_PERMISSION_GROUP:
466                 return getPermissionGroupResStrMaxLen(index);
467             case TAG_PERMISSION_TREE:
468                 return getPermissionTreeResStrMaxLen(index);
469             case TAG_PROPERTY:
470                 return getPropertyResStrMaxLen(index);
471             case TAG_PROVIDER:
472                 return getProviderResStrMaxLen(index);
473             case TAG_RECEIVER:
474                 return getReceiverResStrMaxLen(index);
475             case TAG_SERVICE:
476                 return getServiceResStrMaxLen(index);
477             case TAG_USES_FEATURE:
478                 return getUsesFeatureResStrMaxLen(index);
479             case TAG_USES_LIBRARY:
480                 return getUsesLibraryResStrMaxLen(index);
481             case TAG_USES_NATIVE_LIBRARY:
482                 return getUsesNativeLibraryResStrMaxLen(index);
483             case TAG_USES_PERMISSION:
484             case TAG_USES_PERMISSION_SDK_23:
485             case TAG_USES_PERMISSION_SDK_M:
486                 return getUsesPermissionResStrMaxLen(index);
487             default:
488                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
489         }
490     }
491 
getActionResStrMaxLen(@tyleableRes int index)492     private static int getActionResStrMaxLen(@StyleableRes int index) {
493         switch (index) {
494             case R.styleable.AndroidManifestAction_name:
495                 return MAX_ATTR_LEN_NAME;
496             default:
497                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
498         }
499     }
500 
getActivityResStrMaxLen(@tyleableRes int index)501     private static int getActivityResStrMaxLen(@StyleableRes int index) {
502         switch (index) {
503             case R.styleable.AndroidManifestActivity_name:
504             case R.styleable.AndroidManifestActivity_parentActivityName:
505             case R.styleable.AndroidManifestActivity_permission:
506             case R.styleable.AndroidManifestActivity_process:
507             case R.styleable.AndroidManifestActivity_taskAffinity:
508                 return MAX_ATTR_LEN_NAME;
509             default:
510                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
511         }
512     }
513 
getActivityAliasResStrMaxLen(@tyleableRes int index)514     private static int getActivityAliasResStrMaxLen(@StyleableRes int index) {
515         switch (index) {
516             case R.styleable.AndroidManifestActivityAlias_name:
517             case R.styleable.AndroidManifestActivityAlias_permission:
518             case R.styleable.AndroidManifestActivityAlias_targetActivity:
519                 return MAX_ATTR_LEN_NAME;
520             default:
521                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
522         }
523     }
524 
getApplicationResStrMaxLen(@tyleableRes int index)525     private static int getApplicationResStrMaxLen(@StyleableRes int index) {
526         switch (index) {
527             case R.styleable.AndroidManifestApplication_backupAgent:
528             case R.styleable.AndroidManifestApplication_manageSpaceActivity:
529             case R.styleable.AndroidManifestApplication_name:
530             case R.styleable.AndroidManifestApplication_permission:
531             case R.styleable.AndroidManifestApplication_process:
532             case R.styleable.AndroidManifestApplication_requiredAccountType:
533             case R.styleable.AndroidManifestApplication_restrictedAccountType:
534             case R.styleable.AndroidManifestApplication_taskAffinity:
535             case R.styleable.AndroidManifestApplication_zygotePreloadName:
536                 return MAX_ATTR_LEN_NAME;
537             default:
538                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
539         }
540     }
541 
getCategoryResStrMaxLen(@tyleableRes int index)542     private static int getCategoryResStrMaxLen(@StyleableRes int index) {
543         switch (index) {
544             case R.styleable.AndroidManifestCategory_name:
545                 return MAX_ATTR_LEN_NAME;
546             default:
547                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
548         }
549     }
550 
getDataResStrMaxLen(@tyleableRes int index)551     private static int getDataResStrMaxLen(@StyleableRes int index) {
552         switch (index) {
553             case R.styleable.AndroidManifestData_host:
554             case R.styleable.AndroidManifestData_port:
555             case R.styleable.AndroidManifestData_scheme:
556                 return MAX_ATTR_LEN_URL_COMPONENT;
557             case R.styleable.AndroidManifestData_mimeType:
558                 return MAX_ATTR_LEN_MIMETYPE;
559             case R.styleable.AndroidManifestData_mimeGroup:
560                 return MAX_ATTR_LEN_NAME;
561             case R.styleable.AndroidManifestData_path:
562             case R.styleable.AndroidManifestData_pathPattern:
563             case R.styleable.AndroidManifestData_pathPrefix:
564             case R.styleable.AndroidManifestData_pathSuffix:
565             case R.styleable.AndroidManifestData_pathAdvancedPattern:
566             case R.styleable.AndroidManifestData_query:
567             case R.styleable.AndroidManifestData_queryPattern:
568             case R.styleable.AndroidManifestData_queryPrefix:
569             case R.styleable.AndroidManifestData_querySuffix:
570             case R.styleable.AndroidManifestData_queryAdvancedPattern:
571             case R.styleable.AndroidManifestData_fragment:
572             case R.styleable.AndroidManifestData_fragmentPattern:
573             case R.styleable.AndroidManifestData_fragmentPrefix:
574             case R.styleable.AndroidManifestData_fragmentSuffix:
575             case R.styleable.AndroidManifestData_fragmentAdvancedPattern:
576                 return MAX_ATTR_LEN_PATH;
577             default:
578                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
579         }
580     }
581 
getGrantUriPermissionResStrMaxLen(@tyleableRes int index)582     private static int getGrantUriPermissionResStrMaxLen(@StyleableRes int index) {
583         switch (index) {
584             case R.styleable.AndroidManifestGrantUriPermission_path:
585             case R.styleable.AndroidManifestGrantUriPermission_pathPattern:
586             case R.styleable.AndroidManifestGrantUriPermission_pathPrefix:
587                 return MAX_ATTR_LEN_PATH;
588             default:
589                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
590         }
591     }
592 
getInstrumentationResStrMaxLen(@tyleableRes int index)593     private static int getInstrumentationResStrMaxLen(@StyleableRes int index) {
594         switch (index) {
595             case R.styleable.AndroidManifestInstrumentation_targetPackage:
596                 return MAX_ATTR_LEN_PACKAGE;
597             case R.styleable.AndroidManifestInstrumentation_name:
598             case R.styleable.AndroidManifestInstrumentation_targetProcesses:
599                 return MAX_ATTR_LEN_NAME;
600             default:
601                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
602         }
603     }
604 
getManifestResStrMaxLen(@tyleableRes int index)605     private static int getManifestResStrMaxLen(@StyleableRes int index) {
606         switch (index) {
607             case R.styleable.AndroidManifest_sharedUserId:
608                 return MAX_ATTR_LEN_PACKAGE;
609             case R.styleable.AndroidManifest_versionName:
610                 return MAX_ATTR_LEN_NAME;
611             default:
612                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
613         }
614     }
615 
getMetaDataResStrMaxLen(@tyleableRes int index)616     private static int getMetaDataResStrMaxLen(@StyleableRes int index) {
617         switch (index) {
618             case R.styleable.AndroidManifestMetaData_name:
619                 return MAX_ATTR_LEN_NAME;
620             case R.styleable.AndroidManifestMetaData_value:
621                 return MAX_ATTR_LEN_VALUE;
622             default:
623                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
624         }
625     }
626 
getOverlayResStrMaxLen(@tyleableRes int index)627     private static int getOverlayResStrMaxLen(@StyleableRes int index) {
628         switch (index) {
629             case R.styleable.AndroidManifestResourceOverlay_targetPackage:
630                 return MAX_ATTR_LEN_PACKAGE;
631             case R.styleable.AndroidManifestResourceOverlay_category:
632             case R.styleable.AndroidManifestResourceOverlay_requiredSystemPropertyName:
633             case R.styleable.AndroidManifestResourceOverlay_targetName:
634                 return MAX_ATTR_LEN_NAME;
635             case R.styleable.AndroidManifestResourceOverlay_requiredSystemPropertyValue:
636                 return PROP_VALUE_MAX;
637             default:
638                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
639         }
640     }
641 
getPathPermissionResStrMaxLen(@tyleableRes int index)642     private static int getPathPermissionResStrMaxLen(@StyleableRes int index) {
643         switch (index) {
644             case R.styleable.AndroidManifestPathPermission_permission:
645             case R.styleable.AndroidManifestPathPermission_readPermission:
646             case R.styleable.AndroidManifestPathPermission_writePermission:
647                 return MAX_ATTR_LEN_NAME;
648             case R.styleable.AndroidManifestPathPermission_path:
649             case R.styleable.AndroidManifestPathPermission_pathPattern:
650             case R.styleable.AndroidManifestPathPermission_pathPrefix:
651                 return MAX_ATTR_LEN_PATH;
652             default:
653                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
654         }
655     }
656 
getPermissionResStrMaxLen(@tyleableRes int index)657     private static int getPermissionResStrMaxLen(@StyleableRes int index) {
658         switch (index) {
659             case R.styleable.AndroidManifestPermission_permissionGroup:
660                 return MAX_ATTR_LEN_PERMISSION_GROUP;
661             case R.styleable.AndroidManifestPermission_name:
662                 return MAX_ATTR_LEN_NAME;
663             default:
664                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
665         }
666     }
667 
getPermissionGroupResStrMaxLen(@tyleableRes int index)668     private static int getPermissionGroupResStrMaxLen(@StyleableRes int index) {
669         switch (index) {
670             case R.styleable.AndroidManifestPermissionGroup_name:
671                 return MAX_ATTR_LEN_NAME;
672             default:
673                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
674         }
675     }
676 
getPermissionTreeResStrMaxLen(@tyleableRes int index)677     private static int getPermissionTreeResStrMaxLen(@StyleableRes int index) {
678         switch (index) {
679             case R.styleable.AndroidManifestPermissionTree_name:
680                 return MAX_ATTR_LEN_NAME;
681             default:
682                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
683         }
684     }
685 
getPropertyResStrMaxLen(@tyleableRes int index)686     private static int getPropertyResStrMaxLen(@StyleableRes int index) {
687         switch (index) {
688             case R.styleable.AndroidManifestProperty_name:
689                 return MAX_ATTR_LEN_NAME;
690             case R.styleable.AndroidManifestProperty_value:
691                 return MAX_ATTR_LEN_VALUE;
692             default:
693                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
694         }
695     }
696 
getProviderResStrMaxLen(@tyleableRes int index)697     private static int getProviderResStrMaxLen(@StyleableRes int index) {
698         switch (index) {
699             case R.styleable.AndroidManifestProvider_name:
700             case R.styleable.AndroidManifestProvider_permission:
701             case R.styleable.AndroidManifestProvider_process:
702             case R.styleable.AndroidManifestProvider_readPermission:
703             case R.styleable.AndroidManifestProvider_writePermission:
704                 return MAX_ATTR_LEN_NAME;
705             default:
706                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
707         }
708     }
709 
getReceiverResStrMaxLen(@tyleableRes int index)710     private static int getReceiverResStrMaxLen(@StyleableRes int index) {
711         switch (index) {
712             case R.styleable.AndroidManifestReceiver_name:
713             case R.styleable.AndroidManifestReceiver_permission:
714             case R.styleable.AndroidManifestReceiver_process:
715                 return MAX_ATTR_LEN_NAME;
716             default:
717                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
718         }
719     }
720 
getServiceResStrMaxLen(@tyleableRes int index)721     private static int getServiceResStrMaxLen(@StyleableRes int index) {
722         switch (index) {
723             case R.styleable.AndroidManifestReceiver_name:
724             case R.styleable.AndroidManifestReceiver_permission:
725             case R.styleable.AndroidManifestReceiver_process:
726                 return MAX_ATTR_LEN_NAME;
727             default:
728                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
729         }
730     }
731 
getUsesFeatureResStrMaxLen(@tyleableRes int index)732     private static int getUsesFeatureResStrMaxLen(@StyleableRes int index) {
733         switch (index) {
734             case R.styleable.AndroidManifestUsesFeature_name:
735                 return MAX_ATTR_LEN_NAME;
736             default:
737                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
738         }
739     }
740 
getUsesLibraryResStrMaxLen(@tyleableRes int index)741     private static int getUsesLibraryResStrMaxLen(@StyleableRes int index) {
742         switch (index) {
743             case R.styleable.AndroidManifestUsesLibrary_name:
744                 return MAX_ATTR_LEN_NAME;
745             default:
746                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
747         }
748     }
749 
getUsesNativeLibraryResStrMaxLen(@tyleableRes int index)750     private static int getUsesNativeLibraryResStrMaxLen(@StyleableRes int index) {
751         switch (index) {
752             case R.styleable.AndroidManifestUsesNativeLibrary_name:
753                 return MAX_ATTR_LEN_NAME;
754             default:
755                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
756         }
757     }
758 
getUsesPermissionResStrMaxLen(@tyleableRes int index)759     private static int getUsesPermissionResStrMaxLen(@StyleableRes int index) {
760         switch (index) {
761             case R.styleable.AndroidManifestUsesPermission_name:
762                 return MAX_ATTR_LEN_NAME;
763             default:
764                 return DEFAULT_MAX_STRING_ATTR_LENGTH;
765         }
766     }
767 
initializeCounter(String tag, int max)768     private void initializeCounter(String tag, int max) {
769         int idx = getCounterIdx(tag);
770         if (mTagCounters[idx] == null) {
771             mTagCounters[idx] = new TagCounter();
772         }
773         mTagCounters[idx].reset(max);
774         mChildTagMask |= 1 << idx;
775     }
776 
isComponentNameAttr(String name)777     private boolean isComponentNameAttr(String name) {
778         switch (mTag) {
779             case TAG_ACTIVITY:
780                 switch (name) {
781                     case TAG_ATTR_NAME:
782                     case TAG_ATTR_PARENT_ACTIVITY_NAME:
783                         return true;
784                     default:
785                         return false;
786                 }
787             case TAG_ACTIVITY_ALIAS:
788                 switch (name) {
789                     case TAG_ATTR_TARGET_ACTIVITY:
790                         return true;
791                     default:
792                         return false;
793                 }
794             case TAG_APPLICATION:
795                 switch (name) {
796                     case TAG_ATTR_BACKUP_AGENT:
797                     case TAG_ATTR_NAME:
798                     case TAG_ATTR_ZYGOTE_PRELOAD_NAME:
799                         return true;
800                     default:
801                         return false;
802                 }
803             case TAG_INSTRUMENTATION:
804             case TAG_PROVIDER:
805             case TAG_RECEIVER:
806             case TAG_SERVICE:
807                 switch (name) {
808                     case TAG_ATTR_NAME:
809                         return true;
810                     default:
811                         return false;
812                 }
813             default:
814                 return false;
815         }
816     }
817 
isComponentNameAttr(@tyleableRes int index)818     private boolean isComponentNameAttr(@StyleableRes int index) {
819         switch (mTag) {
820             case TAG_ACTIVITY:
821                 return index == R.styleable.AndroidManifestActivity_name
822                         || index == R.styleable.AndroidManifestActivity_parentActivityName;
823             case TAG_ACTIVITY_ALIAS:
824                 return index == R.styleable.AndroidManifestActivityAlias_targetActivity;
825             case TAG_APPLICATION:
826                 return index == R.styleable.AndroidManifestApplication_backupAgent
827                         || index == R.styleable.AndroidManifestApplication_name
828                         || index == R.styleable.AndroidManifestApplication_zygotePreloadName;
829             case TAG_INSTRUMENTATION:
830                 return index ==  R.styleable.AndroidManifestInstrumentation_name;
831             case TAG_PROVIDER:
832                 return index ==  R.styleable.AndroidManifestProvider_name;
833             case TAG_RECEIVER:
834                 return index ==  R.styleable.AndroidManifestReceiver_name;
835             case TAG_SERVICE:
836                 return index ==  R.styleable.AndroidManifestService_name;
837             default:
838                 return false;
839         }
840     }
841 
hasChild(String tag)842     boolean hasChild(String tag) {
843         return (mChildTagMask & (1 << getCounterIdx(tag))) != 0;
844     }
845 
validateComponentName(CharSequence name)846     void validateComponentName(CharSequence name) {
847         boolean isStart = true;
848         for (int i = 0; i < name.length(); i++) {
849             if (BAD_COMPONENT_NAME_CHARS.indexOf(name.charAt(i)) >= 0) {
850                 Slog.e(TAG, name + " is not a valid Java class name");
851                 throw new SecurityException(name + " is not a valid Java class name");
852             }
853         }
854     }
855 
validateStrAttr(String attrName, String attrValue)856     void validateStrAttr(String attrName, String attrValue) {
857         if (attrValue != null && attrValue.length() > getAttrStrMaxLen(attrName)) {
858             throw new SecurityException("String length limit exceeded for attribute " + attrName
859                     + " in " + mTag);
860         }
861         if (isComponentNameAttr(attrName)) {
862             validateComponentName(attrValue);
863         }
864     }
865 
validateResStrAttr(@tyleableRes int index, CharSequence stringValue)866     void validateResStrAttr(@StyleableRes int index, CharSequence stringValue) {
867         if (stringValue != null && stringValue.length() > getResStrMaxLen(index)) {
868             throw new SecurityException("String length limit exceeded for attribute in " + mTag);
869         }
870         if (isComponentNameAttr(index)) {
871             validateComponentName(stringValue);
872         }
873     }
874 
validateComponentMetadata(String value)875     void validateComponentMetadata(String value) {
876         mTotalComponentMetadataSize += value.length();
877         if (mTotalComponentMetadataSize > MAX_TOTAL_META_DATA_SIZE) {
878             throw new SecurityException("Max total meta data size limit exceeded for " + mTag);
879         }
880     }
881 
seen(@onNull Element element)882     void seen(@NonNull Element element) {
883         TagCounter counter = mTagCounters[getCounterIdx(element.mTag)];
884         if (counter != null) {
885             counter.increment();
886             if (!counter.isValid()) {
887                 throw new SecurityException("The number of child " + element.mTag
888                         + " elements exceeded the max allowed in " + this.mTag);
889             }
890         }
891     }
892 }
893