Clear/restore calling identity in AccessibilityInteractionClient

To quote sendAccessibilityEvent(), "it is possible that this manager is
in the same process as the service but client using it is called through
Binder from another process."

Bug: 21737301
Change-Id: I8d4699a0ca8187a12235741ce420948061798f27

1 files changed, 16 insertions, 0 deletions

diff --git a/core/java/android/view/accessibility/AccessibilityInteractionClient.java b/core/java/android/view/accessibility/AccessibilityInteractionClient.java
index db78ec5..b49cbc6 100644
--- a/core/java/android/view/accessibility/AccessibilityInteractionClient.java
+++ b/core/java/android/view/accessibility/AccessibilityInteractionClient.java
@@ -186,7 +186,9 @@ public final class AccessibilityInteractionClient
                 if (DEBUG) {
                     Log.i(LOG_TAG, "Window cache miss");
                 }
+                final long identityToken = Binder.clearCallingIdentity();
                 window = connection.getWindow(accessibilityWindowId);
+                Binder.restoreCallingIdentity(identityToken);
                 if (window != null) {
                     sAccessibilityCache.addWindow(window);
                     return window;
@@ -222,7 +224,9 @@ public final class AccessibilityInteractionClient
                 if (DEBUG) {
                     Log.i(LOG_TAG, "Windows cache miss");
                 }
+                final long identityToken = Binder.clearCallingIdentity();
                 windows = connection.getWindows();
+                Binder.restoreCallingIdentity(identityToken);
                 if (windows != null) {
                     final int windowCount = windows.size();
                     for (int i = 0; i < windowCount; i++) {
@@ -282,9 +286,11 @@ public final class AccessibilityInteractionClient
                     }
                 }
                 final int interactionId = mInteractionIdCounter.getAndIncrement();
+                final long identityToken = Binder.clearCallingIdentity();
                 final boolean success = connection.findAccessibilityNodeInfoByAccessibilityId(
                         accessibilityWindowId, accessibilityNodeId, interactionId, this,
                         prefetchFlags, Thread.currentThread().getId());
+                Binder.restoreCallingIdentity(identityToken);
                 // If the scale is zero the call has failed.
                 if (success) {
                     List<AccessibilityNodeInfo> infos = getFindAccessibilityNodeInfosResultAndClear(
@@ -328,9 +334,11 @@ public final class AccessibilityInteractionClient
             IAccessibilityServiceConnection connection = getConnection(connectionId);
             if (connection != null) {
                 final int interactionId = mInteractionIdCounter.getAndIncrement();
+                final long identityToken = Binder.clearCallingIdentity();
                 final boolean success = connection.findAccessibilityNodeInfosByViewId(
                         accessibilityWindowId, accessibilityNodeId, viewId, interactionId, this,
                         Thread.currentThread().getId());
+                Binder.restoreCallingIdentity(identityToken);
                 if (success) {
                     List<AccessibilityNodeInfo> infos = getFindAccessibilityNodeInfosResultAndClear(
                             interactionId);
@@ -374,9 +382,11 @@ public final class AccessibilityInteractionClient
             IAccessibilityServiceConnection connection = getConnection(connectionId);
             if (connection != null) {
                 final int interactionId = mInteractionIdCounter.getAndIncrement();
+                final long identityToken = Binder.clearCallingIdentity();
                 final boolean success = connection.findAccessibilityNodeInfosByText(
                         accessibilityWindowId, accessibilityNodeId, text, interactionId, this,
                         Thread.currentThread().getId());
+                Binder.restoreCallingIdentity(identityToken);
                 if (success) {
                     List<AccessibilityNodeInfo> infos = getFindAccessibilityNodeInfosResultAndClear(
                             interactionId);
@@ -419,9 +429,11 @@ public final class AccessibilityInteractionClient
             IAccessibilityServiceConnection connection = getConnection(connectionId);
             if (connection != null) {
                 final int interactionId = mInteractionIdCounter.getAndIncrement();
+                final long identityToken = Binder.clearCallingIdentity();
                 final boolean success = connection.findFocus(accessibilityWindowId,
                         accessibilityNodeId, focusType, interactionId, this,
                         Thread.currentThread().getId());
+                Binder.restoreCallingIdentity(identityToken);
                 if (success) {
                     AccessibilityNodeInfo info = getFindAccessibilityNodeInfoResultAndClear(
                             interactionId);
@@ -461,9 +473,11 @@ public final class AccessibilityInteractionClient
             IAccessibilityServiceConnection connection = getConnection(connectionId);
             if (connection != null) {
                 final int interactionId = mInteractionIdCounter.getAndIncrement();
+                final long identityToken = Binder.clearCallingIdentity();
                 final boolean success = connection.focusSearch(accessibilityWindowId,
                         accessibilityNodeId, direction, interactionId, this,
                         Thread.currentThread().getId());
+                Binder.restoreCallingIdentity(identityToken);
                 if (success) {
                     AccessibilityNodeInfo info = getFindAccessibilityNodeInfoResultAndClear(
                             interactionId);
@@ -502,9 +516,11 @@ public final class AccessibilityInteractionClient
             IAccessibilityServiceConnection connection = getConnection(connectionId);
             if (connection != null) {
                 final int interactionId = mInteractionIdCounter.getAndIncrement();
+                final long identityToken = Binder.clearCallingIdentity();
                 final boolean success = connection.performAccessibilityAction(
                         accessibilityWindowId, accessibilityNodeId, action, arguments,
                         interactionId, this, Thread.currentThread().getId());
+                Binder.restoreCallingIdentity(identityToken);
                 if (success) {
                     return getPerformAccessibilityActionResultAndClear(interactionId);
                 }