DO NOT MERGE: This test verifies security vulnerability in

SMS: Apps can bypass the SMS short code notification prompt

Bug: 22314646

Change-Id: Ib60056755eda50cc2108dacaeb2bc8101c1ead46
Signed-off-by: Upendra <pupendra@google.com>

CtsTestCaseList.mk

@@ -168,7 +168,8 @@ cts_test_packages := \
     CtsViewTestCases \
     CtsWebkitTestCases \
     CtsWebGLTestCases \
-    CtsWidgetTestCases
+    CtsWidgetTestCases \
+    CtsSMSSendConfirmationCheckTestCases
 
 # All APKs that need to be scanned by the coverage utilities.
 CTS_COVERAGE_TEST_CASE_LIST := \

tests/tests/smssendconfirmationcheck/Android.mk

+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH:= $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE_TAGS := optional
+
+LOCAL_MODULE_PATH := $(TARGET_OUT_DATA_APPS)
+
+# Include both the 32 and 64 bit versions
+#LOCAL_MULTILIB := both
+
+LOCAL_STATIC_JAVA_LIBRARIES := ctstestrunner
+
+LOCAL_JAVA_LIBRARIES := android.test.runner
+
+LOCAL_SRC_FILES := $(call all-java-files-under, src)
+
+LOCAL_PACKAGE_NAME := CtsSMSSendConfirmationCheckTestCases
+
+LOCAL_SDK_VERSION := current
+
+include $(BUILD_CTS_PACKAGE)
+
+include $(call all-makefiles-under,$(LOCAL_PATH))

tests/tests/smssendconfirmationcheck/AndroidManifest.xml

+<?xml version="1.0" encoding="utf-8"?>
+<!--
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.android.cts.smssendconfirmationcheck">
+
+    <uses-permission android:name="android.permission.DISABLE_KEYGUARD" />
+
+    <permission android:name="android.permission.SEND_SMS_NO_CONFIRMATION"
+                android:protectionLevel="normal"/>
+    <uses-permission android:name="android.permission.SEND_SMS_NO_CONFIRMATION"/>
+    <uses-permission android:name="android.permission.SEND_SMS"/>
+    <uses-permission android:name="android.permission.READ_SMS"/>
+
+    <application>
+        <uses-library android:name="android.test.runner"/>
+    </application>
+
+    <instrumentation android:name="android.support.test.runner.AndroidJUnitRunner"
+                     android:targetPackage="com.android.cts.smssendconfirmationcheck"
+                     android:label="CTS tests of com.android.cts.smssendconfirmationcheck">
+        <meta-data android:name="listener"
+            android:value="com.android.cts.runner.CtsTestRunListener" />
+    </instrumentation>
+
+</manifest>

tests/tests/smssendconfirmationcheck/src/android/smssendconfirmationcheck/cts/SMSSendConfirmationCheck.java

+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.smssendconfirmationcheck.cts;
+
+import android.content.ContentResolver;
+import android.database.Cursor;
+import android.net.Uri;
+import android.os.SystemClock;
+import android.telephony.SmsManager;
+import android.test.AndroidTestCase;
+
+public class SMSSendConfirmationCheck extends AndroidTestCase {
+
+    /*
+     * The following method tries to send a short code SMS via default SMS API (silently). If
+     * the message is sent (no confirmation displayed to user), the SMS db size will not
+     * match the previous db size.
+     */
+
+    public void testSMSSendingExploit() throws Exception {
+        int inboxSizeBeforeExploit = getSMSInboxSize();
+        SmsManager manager = SmsManager.getDefault();
+        manager.sendTextMessage("25578", null, "STOP", null, null);
+        SystemClock.sleep(250);
+        int inboxSizeAfterExploit = getSMSInboxSize();
+        assertTrue("Device is vulnerable to bug #22314646!! For more information " +
+                "please refer - https://android.googlesource.com/platform/frameworks/" +
+                "opt/telephony/+/ce058be%5E!/", inboxSizeBeforeExploit == inboxSizeAfterExploit);
+    }
+
+    public int getSMSInboxSize() {
+        ContentResolver resolver = mContext.getContentResolver();
+        Cursor cur = resolver.query(Uri.parse("content://sms/"), null, null, null, null);
+        int count = cur.getCount();
+        cur.close();
+        return count;
+    }
+}