From 5cac07ddd71b4624dff6adc361ada0d8fcd2c150 Mon Sep 17 00:00:00 2001
From: Sunny Goyal <sunnygoyal@google.com>
Date: Wed, 31 May 2023 10:18:52 -0700
Subject: [PATCH 1/4] Fixing icon cache thrashing due to an unsupported icon

Bug: 284032965
Test: Verified by reproducing the use case
Flag: N/A
(cherry picked from commit 41737b3e8bbe4c72ed8570771b7d64fdbcfcebbb)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c42f37627c800c66974737e33eb4bf1a34dc04ce)
Merged-In: I835dd545a01eb2fd7990e0fd5ad51bac0e4b1f33
Change-Id: I835dd545a01eb2fd7990e0fd5ad51bac0e4b1f33
---
 .../android/launcher3/icons/IconCache.java    | 34 +++++++++++++------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/src/com/android/launcher3/icons/IconCache.java b/src/com/android/launcher3/icons/IconCache.java
index 3c63f26ec4..72feb7b572 100644
--- a/src/com/android/launcher3/icons/IconCache.java
+++ b/src/com/android/launcher3/icons/IconCache.java
@@ -100,6 +100,7 @@ public class IconCache extends BaseIconCache {
     private final UserCache mUserManager;
     private final InstantAppResolver mInstantAppResolver;
     private final IconProvider mIconProvider;
+    private final HandlerRunnable mCancelledRunnable;
 
     private final SparseArray<BitmapInfo> mWidgetCategoryBitmapInfos;
 
@@ -121,6 +122,10 @@ public class IconCache extends BaseIconCache {
         mInstantAppResolver = InstantAppResolver.newInstance(mContext);
         mIconProvider = iconProvider;
         mWidgetCategoryBitmapInfos = new SparseArray<>();
+
+        mCancelledRunnable = new HandlerRunnable(
+                mWorkerHandler, () -> null, MAIN_EXECUTOR, c -> { });
+        mCancelledRunnable.cancel();
     }
 
     @Override
@@ -176,23 +181,30 @@ public class IconCache extends BaseIconCache {
     public HandlerRunnable updateIconInBackground(final ItemInfoUpdateReceiver caller,
             final ItemInfoWithIcon info) {
         Preconditions.assertUIThread();
+        Supplier<ItemInfoWithIcon> task;
+        if (info instanceof AppInfo || info instanceof WorkspaceItemInfo) {
+            task = () -> {
+                getTitleAndIcon(info, false);
+                return info;
+            };
+        } else if (info instanceof PackageItemInfo pii) {
+            task = () -> {
+                getTitleAndIconForApp(pii, false);
+                return pii;
+            };
+        } else {
+            Log.i(TAG, "Icon update not supported for "
+                    + info == null ? "null" : info.getClass().getName());
+            return mCancelledRunnable;
+        }
+
         if (mPendingIconRequestCount <= 0) {
             MODEL_EXECUTOR.setThreadPriority(Process.THREAD_PRIORITY_FOREGROUND);
         }
         mPendingIconRequestCount++;
 
         HandlerRunnable<ItemInfoWithIcon> request = new HandlerRunnable<>(mWorkerHandler,
-                () -> {
-                    if (info instanceof AppInfo || info instanceof WorkspaceItemInfo) {
-                        getTitleAndIcon(info, false);
-                    } else if (info instanceof PackageItemInfo) {
-                        getTitleAndIconForApp((PackageItemInfo) info, false);
-                    }
-                    return info;
-                },
-                MAIN_EXECUTOR,
-                caller::reapplyItemInfo,
-                this::onIconRequestEnd);
+                task, MAIN_EXECUTOR, caller::reapplyItemInfo, this::onIconRequestEnd);
         Utilities.postAsyncCallback(mWorkerHandler, request);
         return request;
     }

From 506be7ec6acc816a5e443a921187fef379afe727 Mon Sep 17 00:00:00 2001
From: Sunny Goyal <sunnygoyal@google.com>
Date: Sat, 3 Jun 2023 08:08:37 -0700
Subject: [PATCH 2/4] Fixing syntax error due to java-version changes

Bug: 284032965
Test: Presubmit
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:250661e172780570a66768d443071b32059cc57d)
Merged-In: I2ee30dfa5e4170272b5353f270a69b38750a0bd5
Change-Id: I2ee30dfa5e4170272b5353f270a69b38750a0bd5
---
 src/com/android/launcher3/icons/IconCache.java | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/com/android/launcher3/icons/IconCache.java b/src/com/android/launcher3/icons/IconCache.java
index 72feb7b572..bc57f66b87 100644
--- a/src/com/android/launcher3/icons/IconCache.java
+++ b/src/com/android/launcher3/icons/IconCache.java
@@ -187,10 +187,10 @@ public class IconCache extends BaseIconCache {
                 getTitleAndIcon(info, false);
                 return info;
             };
-        } else if (info instanceof PackageItemInfo pii) {
+        } else if (info instanceof PackageItemInfo) {
             task = () -> {
-                getTitleAndIconForApp(pii, false);
-                return pii;
+                getTitleAndIconForApp((PackageItemInfo) info, false);
+                return info;
             };
         } else {
             Log.i(TAG, "Icon update not supported for "

From bc519ed01cc2f82af3bdd264ce44ef7487cdeaed Mon Sep 17 00:00:00 2001
From: Pinyao Ting <pinyaoting@google.com>
Date: Tue, 16 May 2023 22:43:45 +0000
Subject: [PATCH 3/4] Revert "Grant Launcher permission to access AppSearch"

This reverts commit 0bae1f55e3fa32380298297201f46e0ad31dd3a8.

Reason for revert: no product dependencies and it's causing problems in automation tests

Bug: 283006437
Test: NexusLauncherTests:com.android.quickstep.FallbackRecentsTest
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:bdf75772ea2bfd60f004a5d326478bd83deda9a0)
Merged-In: I831e563c41a368d981af3a05063bf3a868c24b79
Change-Id: I831e563c41a368d981af3a05063bf3a868c24b79
---
 AndroidManifest-common.xml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/AndroidManifest-common.xml b/AndroidManifest-common.xml
index 0c7b48fe66..60ddfb6ce5 100644
--- a/AndroidManifest-common.xml
+++ b/AndroidManifest-common.xml
@@ -44,7 +44,6 @@
     <!-- for rotating surface by arbitrary degree -->
     <uses-permission android:name="android.permission.ROTATE_SURFACE_FLINGER" />
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
-    <uses-permission android:name="android.permission.READ_HOME_APP_SEARCH_DATA" />
 
     <!--
     Permissions required for read/write access to the workspace data. These permission name

From 8ce151b4ce5d222a797fdbf57d0a4699918a30c1 Mon Sep 17 00:00:00 2001
From: Pinyao Ting <pinyaoting@google.com>
Date: Thu, 1 Jun 2023 18:12:44 -0700
Subject: [PATCH 4/4] [RESTRICT AUTOMERGE] Fix permission issue in legacy
 shortcut

When building legacy shortcut, Launcher calls
PackageManager#resolveActivity to retrieve necessary permission to
launch the intent.

However, when the source app wraps an arbitrary intent within
Intent#createChooser, the existing logic will fail because launching
Chooser doesn't require additional permission.

This CL fixes the security vulnerability by performing the permission
check against the intent that is wrapped within.

Bug: 270152142
Test: manual
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:f0261b5b38cd95bc1522780a7538a5f4ddc1b119)
Merged-In: I05ccbde0a873569f24af4d3675a86830ba54c43f
Change-Id: I05ccbde0a873569f24af4d3675a86830ba54c43f
---
 .../android/launcher3/util/PackageManagerHelper.java | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/com/android/launcher3/util/PackageManagerHelper.java b/src/com/android/launcher3/util/PackageManagerHelper.java
index a6a2751dc7..586e0c9e89 100644
--- a/src/com/android/launcher3/util/PackageManagerHelper.java
+++ b/src/com/android/launcher3/util/PackageManagerHelper.java
@@ -145,6 +145,18 @@ public class PackageManagerHelper {
      * any permissions
      */
     public boolean hasPermissionForActivity(Intent intent, String srcPackage) {
+        // b/270152142
+        if (Intent.ACTION_CHOOSER.equals(intent.getAction())) {
+            final Bundle extras = intent.getExtras();
+            if (extras == null) {
+                return true;
+            }
+            // If given intent is ACTION_CHOOSER, verify srcPackage has permission over EXTRA_INTENT
+            intent = (Intent) extras.getParcelable(Intent.EXTRA_INTENT);
+            if (intent == null) {
+                return true;
+            }
+        }
         ResolveInfo target = mPm.resolveActivity(intent, 0);
         if (target == null) {
             // Not a valid target