From 6482f16445c578f27cd4104c8202bb0b2bba5d85 Mon Sep 17 00:00:00 2001
From: nielsandriesse <andriesseniels@gmail.com>
Date: Thu, 17 Sep 2020 17:06:39 +1000
Subject: [PATCH] Guard against tapjacking

---
 res/layout-sw400dp/activity_register.xml      |  4 +-
 res/layout-sw400dp/activity_seed.xml          |  6 +-
 .../fragment_enter_public_key.xml             |  8 +-
 res/layout/activity_register.xml              |  4 +-
 res/layout/activity_seed.xml                  |  6 +-
 res/layout/dialog_seed.xml                    |  4 +-
 res/layout/fragment_enter_public_key.xml      |  8 +-
 .../conversation/ConversationItem.java        |  3 +-
 .../activities/CreatePrivateChatActivity.kt   |  8 +-
 .../securesms/loki/views/TapJacking.kt        | 79 +++++++++++++++++++
 10 files changed, 105 insertions(+), 25 deletions(-)
 create mode 100644 src/org/thoughtcrime/securesms/loki/views/TapJacking.kt

diff --git a/res/layout-sw400dp/activity_register.xml b/res/layout-sw400dp/activity_register.xml
index 8cc432c160..6245f922bc 100644
--- a/res/layout-sw400dp/activity_register.xml
+++ b/res/layout-sw400dp/activity_register.xml
@@ -30,7 +30,7 @@
         android:textColor="@color/text"
         android:text="@string/activity_register_explanation" />
 
-    <TextView
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofTextView
         style="@style/SessionIDTextView"
         android:id="@+id/publicKeyTextView"
         android:layout_width="match_parent"
@@ -54,7 +54,7 @@
         android:layout_marginRight="@dimen/massive_spacing"
         android:text="@string/continue_2" />
 
-    <Button
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofButton
         style="@style/Widget.Session.Button.Common.ProminentOutline"
         android:id="@+id/copyButton"
         android:layout_width="match_parent"
diff --git a/res/layout-sw400dp/activity_seed.xml b/res/layout-sw400dp/activity_seed.xml
index 74f44a79d4..e4bfd63a82 100644
--- a/res/layout-sw400dp/activity_seed.xml
+++ b/res/layout-sw400dp/activity_seed.xml
@@ -36,7 +36,7 @@
         android:textColor="@color/text"
         android:text="@string/activity_seed_explanation" />
 
-    <TextView
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofTextView
         style="@style/SessionIDTextView"
         android:id="@+id/seedTextView"
         android:layout_width="match_parent"
@@ -49,7 +49,7 @@
         android:textAlignment="center"
         android:text="nautical novelty populate onion awkward bent etiquette plant submarine itches vipers september axis maximum populate" />
 
-    <TextView
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofTextView
         android:id="@+id/revealButton"
         android:layout_width="match_parent"
         android:layout_height="wrap_content"
@@ -65,7 +65,7 @@
         android:layout_height="0dp"
         android:layout_weight="1"/>
 
-    <Button
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofButton
         style="@style/Widget.Session.Button.Common.ProminentOutline"
         android:id="@+id/copyButton"
         android:layout_width="196dp"
diff --git a/res/layout-sw400dp/fragment_enter_public_key.xml b/res/layout-sw400dp/fragment_enter_public_key.xml
index 9acdc7e6db..e09aae2521 100644
--- a/res/layout-sw400dp/fragment_enter_public_key.xml
+++ b/res/layout-sw400dp/fragment_enter_public_key.xml
@@ -14,7 +14,7 @@
         android:background="?android:dividerHorizontal"
         android:elevation="1dp" />
 
-    <EditText
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofEditText
         style="@style/SessionEditText"
         android:id="@+id/publicKeyEditText"
         android:layout_width="match_parent"
@@ -50,7 +50,7 @@
         android:layout_marginTop="@dimen/large_spacing"
         android:layout_marginRight="@dimen/large_spacing" />
 
-    <TextView
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofTextView
         android:id="@+id/publicKeyTextView"
         android:layout_width="match_parent"
         android:layout_height="wrap_content"
@@ -71,7 +71,7 @@
         android:layout_marginRight="@dimen/large_spacing"
         android:orientation="horizontal">
 
-        <Button
+        <org.thoughtcrime.securesms.loki.views.TapJackingProofButton
             style="@style/Widget.Session.Button.Common.UnimportantFilled"
             android:id="@+id/copyButton"
             android:layout_width="0dp"
@@ -79,7 +79,7 @@
             android:layout_weight="1"
             android:text="@string/copy" />
 
-        <Button
+        <org.thoughtcrime.securesms.loki.views.TapJackingProofButton
             style="@style/Widget.Session.Button.Common.UnimportantFilled"
             android:id="@+id/shareButton"
             android:layout_width="0dp"
diff --git a/res/layout/activity_register.xml b/res/layout/activity_register.xml
index 57a64e2fb3..0a779fe39c 100644
--- a/res/layout/activity_register.xml
+++ b/res/layout/activity_register.xml
@@ -30,7 +30,7 @@
         android:textColor="@color/text"
         android:text="@string/activity_register_explanation" />
 
-    <TextView
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofTextView
         style="@style/SessionIDTextView"
         android:id="@+id/publicKeyTextView"
         android:layout_width="match_parent"
@@ -55,7 +55,7 @@
         android:layout_marginRight="@dimen/massive_spacing"
         android:text="@string/continue_2" />
 
-    <Button
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofButton
         style="@style/Widget.Session.Button.Common.ProminentOutline"
         android:id="@+id/copyButton"
         android:layout_width="match_parent"
diff --git a/res/layout/activity_seed.xml b/res/layout/activity_seed.xml
index 8aacbf3df3..ce1576f7aa 100644
--- a/res/layout/activity_seed.xml
+++ b/res/layout/activity_seed.xml
@@ -36,7 +36,7 @@
         android:textColor="@color/text"
         android:text="@string/activity_seed_explanation" />
 
-    <TextView
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofTextView
         style="@style/SessionIDTextView"
         android:id="@+id/seedTextView"
         android:layout_width="match_parent"
@@ -49,7 +49,7 @@
         android:textAlignment="center"
         android:text="nautical novelty populate onion awkward bent etiquette plant submarine itches vipers september axis maximum populate" />
 
-    <TextView
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofTextView
         android:id="@+id/revealButton"
         android:layout_width="match_parent"
         android:layout_height="wrap_content"
@@ -66,7 +66,7 @@
         android:layout_height="0dp"
         android:layout_weight="1"/>
 
-    <Button
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofButton
         style="@style/Widget.Session.Button.Common.ProminentOutline"
         android:id="@+id/copyButton"
         android:layout_width="196dp"
diff --git a/res/layout/dialog_seed.xml b/res/layout/dialog_seed.xml
index 35fe564c20..57cb48eae0 100644
--- a/res/layout/dialog_seed.xml
+++ b/res/layout/dialog_seed.xml
@@ -20,7 +20,7 @@
         android:textAlignment="center"
         android:textSize="@dimen/medium_font_size" />
 
-    <TextView
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofTextView
         style="@style/SessionIDTextView"
         android:id="@+id/seedTextView"
         android:layout_width="wrap_content"
@@ -56,7 +56,7 @@
             android:layout_weight="1"
             android:text="@string/cancel" />
 
-        <Button
+        <org.thoughtcrime.securesms.loki.views.TapJackingProofButton
             style="@style/Widget.Session.Button.Dialog.Unimportant"
             android:id="@+id/copyButton"
             android:layout_width="0dp"
diff --git a/res/layout/fragment_enter_public_key.xml b/res/layout/fragment_enter_public_key.xml
index ffd53dd34e..c2aa32d1d5 100644
--- a/res/layout/fragment_enter_public_key.xml
+++ b/res/layout/fragment_enter_public_key.xml
@@ -13,7 +13,7 @@
         android:background="?android:dividerHorizontal"
         android:elevation="1dp" />
 
-    <EditText
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofEditText
         style="@style/SmallSessionEditText"
         android:id="@+id/publicKeyEditText"
         android:layout_width="match_parent"
@@ -49,7 +49,7 @@
         android:layout_marginTop="@dimen/large_spacing"
         android:layout_marginRight="@dimen/large_spacing" />
 
-    <TextView
+    <org.thoughtcrime.securesms.loki.views.TapJackingProofTextView
         android:id="@+id/publicKeyTextView"
         android:layout_width="match_parent"
         android:layout_height="wrap_content"
@@ -70,7 +70,7 @@
         android:layout_marginRight="@dimen/large_spacing"
         android:orientation="horizontal">
 
-        <Button
+        <org.thoughtcrime.securesms.loki.views.TapJackingProofButton
             style="@style/Widget.Session.Button.Common.UnimportantFilled"
             android:id="@+id/copyButton"
             android:layout_width="0dp"
@@ -78,7 +78,7 @@
             android:layout_weight="1"
             android:text="@string/copy" />
 
-        <Button
+        <org.thoughtcrime.securesms.loki.views.TapJackingProofButton
             style="@style/Widget.Session.Button.Common.UnimportantFilled"
             android:id="@+id/shareButton"
             android:layout_width="0dp"
diff --git a/src/org/thoughtcrime/securesms/conversation/ConversationItem.java b/src/org/thoughtcrime/securesms/conversation/ConversationItem.java
index a719e8c43e..6bb7970de7 100644
--- a/src/org/thoughtcrime/securesms/conversation/ConversationItem.java
+++ b/src/org/thoughtcrime/securesms/conversation/ConversationItem.java
@@ -89,6 +89,7 @@ import org.thoughtcrime.securesms.linkpreview.LinkPreviewUtil;
 import org.thoughtcrime.securesms.logging.Log;
 import org.thoughtcrime.securesms.loki.utilities.MentionUtilities;
 import org.thoughtcrime.securesms.loki.views.ProfilePictureView;
+import org.thoughtcrime.securesms.loki.views.TapJackingProofLinearLayout;
 import org.thoughtcrime.securesms.mms.GlideRequests;
 import org.thoughtcrime.securesms.mms.ImageSlide;
 import org.thoughtcrime.securesms.mms.PartAuthority;
@@ -129,7 +130,7 @@ import network.loki.messenger.R;
  *
  */
 
-public class ConversationItem extends LinearLayout
+public class ConversationItem extends TapJackingProofLinearLayout
     implements RecipientModifiedListener, BindableConversationItem
 {
   private static final String TAG = ConversationItem.class.getSimpleName();
diff --git a/src/org/thoughtcrime/securesms/loki/activities/CreatePrivateChatActivity.kt b/src/org/thoughtcrime/securesms/loki/activities/CreatePrivateChatActivity.kt
index 41b46c8b70..dd2625bc9d 100644
--- a/src/org/thoughtcrime/securesms/loki/activities/CreatePrivateChatActivity.kt
+++ b/src/org/thoughtcrime/securesms/loki/activities/CreatePrivateChatActivity.kt
@@ -134,10 +134,10 @@ class EnterPublicKeyFragment : Fragment() {
     }
 
     private fun copyPublicKey() {
-        val clipboard = activity!!.getSystemService(Context.CLIPBOARD_SERVICE) as ClipboardManager
+        val clipboard = requireActivity().getSystemService(Context.CLIPBOARD_SERVICE) as ClipboardManager
         val clip = ClipData.newPlainText("Session ID", hexEncodedPublicKey)
         clipboard.setPrimaryClip(clip)
-        Toast.makeText(context!!, R.string.copied_to_clipboard, Toast.LENGTH_SHORT).show()
+        Toast.makeText(requireContext(), R.string.copied_to_clipboard, Toast.LENGTH_SHORT).show()
     }
 
     private fun sharePublicKey() {
@@ -149,8 +149,8 @@ class EnterPublicKeyFragment : Fragment() {
     }
 
     private fun createPrivateChatIfPossible() {
-        val hexEncodedPublicKey = publicKeyEditText.text.trim().toString()
-        (activity!! as CreatePrivateChatActivity).createPrivateChatIfPossible(hexEncodedPublicKey)
+        val hexEncodedPublicKey = publicKeyEditText.text?.trim().toString() ?: ""
+        (requireActivity() as CreatePrivateChatActivity).createPrivateChatIfPossible(hexEncodedPublicKey)
     }
 }
 // endregion
diff --git a/src/org/thoughtcrime/securesms/loki/views/TapJacking.kt b/src/org/thoughtcrime/securesms/loki/views/TapJacking.kt
new file mode 100644
index 0000000000..516b7654f6
--- /dev/null
+++ b/src/org/thoughtcrime/securesms/loki/views/TapJacking.kt
@@ -0,0 +1,79 @@
+package org.thoughtcrime.securesms.loki.views
+
+import android.content.Context
+import android.util.AttributeSet
+import android.view.MotionEvent
+import android.widget.Button
+import android.widget.LinearLayout
+import android.widget.Toast
+
+private fun isPotentialTapJack(event: MotionEvent): Boolean {
+    if (event.flags and MotionEvent.FLAG_WINDOW_IS_OBSCURED == MotionEvent.FLAG_WINDOW_IS_OBSCURED) { return true }
+    if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.Q &&
+        (event.flags and MotionEvent.FLAG_WINDOW_IS_PARTIALLY_OBSCURED == MotionEvent.FLAG_WINDOW_IS_PARTIALLY_OBSCURED)) { return true }
+    return false
+}
+
+open class TapJackingProofButton : androidx.appcompat.widget.AppCompatButton {
+
+    constructor(context: Context) : super(context)
+    constructor(context: Context, attrs: AttributeSet) : super(context, attrs)
+    constructor(context: Context, attrs: AttributeSet, defStyleAttr: Int) : super(context, attrs, defStyleAttr)
+
+    override fun onFilterTouchEventForSecurity(event: MotionEvent): Boolean {
+        if (isPotentialTapJack(event)) {
+            Toast.makeText(context, "Interaction temporarily disabled for security purposes.", Toast.LENGTH_LONG).show()
+            return false
+        } else {
+            return super.onFilterTouchEventForSecurity(event)
+        }
+    }
+}
+
+open class TapJackingProofEditText : androidx.appcompat.widget.AppCompatEditText {
+
+    constructor(context: Context) : super(context)
+    constructor(context: Context, attrs: AttributeSet) : super(context, attrs)
+    constructor(context: Context, attrs: AttributeSet, defStyleAttr: Int) : super(context, attrs, defStyleAttr)
+
+    override fun onFilterTouchEventForSecurity(event: MotionEvent): Boolean {
+        if (isPotentialTapJack(event)) {
+            Toast.makeText(context, "Interaction temporarily disabled for security purposes.", Toast.LENGTH_LONG).show()
+            return false
+        } else {
+            return super.onFilterTouchEventForSecurity(event)
+        }
+    }
+}
+
+open class TapJackingProofTextView : androidx.appcompat.widget.AppCompatTextView {
+
+    constructor(context: Context) : super(context)
+    constructor(context: Context, attrs: AttributeSet) : super(context, attrs)
+    constructor(context: Context, attrs: AttributeSet, defStyleAttr: Int) : super(context, attrs, defStyleAttr)
+
+    override fun onFilterTouchEventForSecurity(event: MotionEvent): Boolean {
+        if (isPotentialTapJack(event)) {
+            Toast.makeText(context, "Interaction temporarily disabled for security purposes.", Toast.LENGTH_LONG).show()
+            return false
+        } else {
+            return super.onFilterTouchEventForSecurity(event)
+        }
+    }
+}
+
+open class TapJackingProofLinearLayout : LinearLayout {
+
+    constructor(context: Context) : super(context)
+    constructor(context: Context, attrs: AttributeSet) : super(context, attrs)
+    constructor(context: Context, attrs: AttributeSet, defStyleAttr: Int) : super(context, attrs, defStyleAttr)
+
+    override fun onFilterTouchEventForSecurity(event: MotionEvent): Boolean {
+        if (isPotentialTapJack(event)) {
+            Toast.makeText(context, "Interaction temporarily disabled for security purposes.", Toast.LENGTH_LONG).show()
+            return false
+        } else {
+            return super.onFilterTouchEventForSecurity(event)
+        }
+    }
+}
\ No newline at end of file