CODEWITHSUNDEEP
androidandroid-intentgoogle-play-consoleandroid-pendingintent
prat
prat

Reputation: 647

Implicit Internal Intent vulnerability showing up when Android app is deployed to the Playstore

Recently I have uploaded my android apk on the app store and its been told that the next upload to Google play store will get rejected and we need to check and resolve it. Below is the screenshot of the message:

enter image description here

They are referring to package name also. Below is the code:

 @Override
    public void onDestroy() {
        cleanup();
        super.onDestroy();
        Intent intent = new Intent("com.test.dummyapp");
        sendBroadcast(intent);
    }

Please assist me how to resolve this.

Below is the code where the component is triggered:

 IntentFilter restartFilter = new IntentFilter("com.test.dummyapp");
        registerReceiver(restartBroadcastReciver, restartFilter);



private BroadcastReceiver restartBroadcastReciver = new BroadcastReceiver() {
        @Override
        public void onReceive(Context context, Intent intent) {
          doBindService();
        }
    };

Upvotes: 4

Views: 3804

Answers (3)

David Wasser
David Wasser

Reputation: 95588

When you do this, you are broadcasting an "implicit Intent". This is dangerous because any app can register to get this (potential leak of information) and any app can also broadcast this Intent (triggering your app).

Intent intent = new Intent("com.test.dummyapp");
sendBroadcast(intent);

To fix this you can use LocalBroadcastManager (it is deprecated, but still works). Using a local broadcast ensures that other apps cannot see your broadcast Intent and other apps cannot trigger your app this way.

See https://developer.android.com/reference/androidx/localbroadcastmanager/content/LocalBroadcastManager

As an alternative, you should be able to make the Intent explicit by setting the package name:

Intent intent = new Intent("com.test.dummyapp");
intent.setPackage("my.package.name");
sendBroadcast(intent);

Upvotes: 5

prat
prat

Reputation: 647

Thanks for the information.

I made some changes to the posted code. Let me know if this works fine.

@Override
public void onDestroy() {
    cleanup();
    super.onDestroy();
    openApp((Context) context,"com.test.dummyapp");
}

public static boolean openApp(Context context, String packageName) {
    PackageManager manager = context.getPackageManager();
    try {
        Intent i = manager.getLaunchIntentForPackage(packageName);
        if (i == null) {
            return false;
        }
        i.addCategory(Intent.CATEGORY_LAUNCHER);
        context.sendBroadcast(i);
        return true;
    } catch (ActivityNotFoundException e) {
        return false;
    }
}

Upvotes: 0

Gabe Sechan
Gabe Sechan

Reputation: 93614

It seems really weird to send a Broadcast in onDestroy. I can't possibly see a use for that, and I can see a lot of problems due to onDestroy being called unexpectedly (rotation, screen size change, etc).

But if you have to do it, use new Intent(getPackageName()). What they're looking for is a hardcoded package name like that. The problem is that if you run 'com.facebook.whateveritscalled' and a piece of malware is installed that named itself that, you would be sending the intent to it. Which if you have extras in the intent could be leaking information to it.

Upvotes: 0

Related Questions