@@ -237,7 +237,7 @@ private boolean startSingleSignOn(Activity activity, String applicationId,
237
237
// Verify that the application whose package name is
238
238
// com.facebook.katana.ProxyAuth
239
239
// has the expected FB app signature.
240
- if (!validateAppSignatureForIntent (activity , intent )) {
240
+ if (!validateActivityIntent (activity , intent )) {
241
241
return false ;
242
242
}
243
243
@@ -254,24 +254,59 @@ private boolean startSingleSignOn(Activity activity, String applicationId,
254
254
}
255
255
256
256
/**
257
- * Query the signature for the application that would be invoked by the
258
- * given intent and verify that it matches the FB application's signature.
257
+ * Helper to validate an activity intent by resolving and checking the
258
+ * provider's package signature.
259
259
*
260
260
* @param context
261
261
* @param intent
262
- * @param validSignature
263
- * @return true if the app's signature matches the expected signature .
262
+ * @return true if the service intent resolution happens successfully and the
263
+ * signatures match .
264
264
*/
265
- private boolean validateAppSignatureForIntent (Context context ,
266
- Intent intent ) {
265
+ private boolean validateActivityIntent (Context context , Intent intent ) {
266
+ ResolveInfo resolveInfo =
267
+ context .getPackageManager ().resolveActivity (intent , 0 );
268
+ if (resolveInfo == null ) {
269
+ return false ;
270
+ }
267
271
272
+ return validateAppSignatureForPackage (
273
+ context ,
274
+ resolveInfo .activityInfo .packageName );
275
+ }
276
+
277
+
278
+ /**
279
+ * Helper to validate a service intent by resolving and checking the
280
+ * provider's package signature.
281
+ *
282
+ * @param context
283
+ * @param intent
284
+ * @return true if the service intent resolution happens successfully and the
285
+ * signatures match.
286
+ */
287
+ private boolean validateServiceIntent (Context context , Intent intent ) {
268
288
ResolveInfo resolveInfo =
269
- context .getPackageManager ().resolveActivity (intent , 0 );
289
+ context .getPackageManager ().resolveService (intent , 0 );
270
290
if (resolveInfo == null ) {
271
291
return false ;
272
292
}
273
293
274
- String packageName = resolveInfo .activityInfo .packageName ;
294
+ return validateAppSignatureForPackage (
295
+ context ,
296
+ resolveInfo .serviceInfo .packageName );
297
+ }
298
+
299
+ /**
300
+ * Query the signature for the application that would be invoked by the
301
+ * given intent and verify that it matches the FB application's signature.
302
+ *
303
+ * @param context
304
+ * @param packageName
305
+ * @return true if the app's signature matches the expected signature.
306
+ */
307
+ private boolean validateAppSignatureForPackage (Context context ,
308
+ String packageName ) {
309
+
275
310
PackageInfo packageInfo ;
276
311
try {
277
312
packageInfo = context .getPackageManager ().getPackageInfo (
@@ -382,7 +417,7 @@ public void authorizeCallback(int requestCode, int resultCode, Intent data) {
382
417
if (description != null ) {
383
418
error = error + ":" + description ;
384
419
}
385
- Log .d ("Facebook-authorize" , "Login failed: " + error );
420
+ Log .d ("Facebook-authorize" , "Login failed: " + error );
386
421
mAuthDialogListener .onFacebookError (
387
422
new FacebookError (error ));
388
423
}
@@ -453,7 +488,7 @@ public boolean extendAccessToken(Context context, ServiceListener serviceListene
453
488
// Verify that the application whose package name is
454
489
// com.facebook.katana
455
490
// has the expected FB app signature.
456
- if (!validateAppSignatureForIntent (context , intent )) {
491
+ if (!validateServiceIntent (context , intent )) {
457
492
return false ;
458
493
}
459
494
0 commit comments