AccessibilityEvent/AccessibilityNodeInfo class name property should be set to only framework classes.

AccessibilityEvent and AccessibilityNodeInfo have a property className which is set to the source
Java class. This is problematic since leads to leaking private classes which would allow an
accessibility service to load classes from other packages. This is strongly undesirable since
not trusted code can be loaded, and hence executed, in the accessibility service. To address
that the class name is set to the most concrete framework class extended by the info/event
source.

bug:5878943

Change-Id: I7b3114ece8772ea2773f5151e21b8a6f2006882a

1 files changed, 15 insertions, 1 deletions

diff --git a/core/java/android/widget/Spinner.java b/core/java/android/widget/Spinner.java
index ec3790e..ecf19b3 100644
--- a/core/java/android/widget/Spinner.java
+++ b/core/java/android/widget/Spinner.java
@@ -29,6 +29,8 @@ import android.util.AttributeSet;
 import android.view.Gravity;
 import android.view.View;
 import android.view.ViewGroup;
+import android.view.accessibility.AccessibilityEvent;
+import android.view.accessibility.AccessibilityNodeInfo;
 
 
 /**
@@ -456,12 +458,24 @@ public class Spinner extends AbsSpinner implements OnClickListener {
 
         return handled;
     }
-    
+
     public void onClick(DialogInterface dialog, int which) {
         setSelection(which);
         dialog.dismiss();
     }
 
+    @Override
+    public void onInitializeAccessibilityEvent(AccessibilityEvent event) {
+        super.onInitializeAccessibilityEvent(event);
+        event.setClassName(Spinner.class.getName());
+    }
+
+    @Override
+    public void onInitializeAccessibilityNodeInfo(AccessibilityNodeInfo info) {
+        super.onInitializeAccessibilityNodeInfo(info);
+        info.setClassName(Spinner.class.getName());
+    }
+
     /**
      * Sets the prompt to display when the dialog is shown.
      * @param prompt the prompt to set