diff options
| author | Hao Ke <haok@google.com> | 2021-09-07 17:31:26 +0000 |
|---|---|---|
| committer | Hao Ke <haok@google.com> | 2021-09-09 15:56:03 +0000 |
| commit | bc8416152b779be1549bbc47d5c7571345409374 (patch) | |
| tree | 8c4a4eb909a2bbf182a1cfb6cd8eee23483c9561 /core/java/android/inputmethodservice/AbstractInputMethodService.java | |
| parent | b626ccc60c692e99ca418ea20be49ccbc6cf870b (diff) | |
Replace untyped Parcel read/write
Description: Replaced `Parcel.readList()` call with empty classLoader.
Calling `Parcel.readList(,null)` could be dangerous as an attacker can
abuse the call to deserialize arbitrary parcelables. To avoid such an
attack vector, we should switch in using `Parcel.readTypedList()`
instead.
Test: atest CtsInstantAppTests
Test: atest CtsWindowManagerDeviceTestCases:MultiWindowTests
Test: atest RemoteTransitionTest
Test: Boot and observe systemUI works
Bug: 195622897
Change-Id: I7c8cb23f6f3d26b1d4d47696e70982797b5f0210
Diffstat (limited to 'core/java/android/inputmethodservice/AbstractInputMethodService.java')
0 files changed, 0 insertions, 0 deletions