Sanitize external intents properly
Also disable auto-download and installs from them Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
This commit is contained in:
@@ -87,7 +87,8 @@
|
||||
android:name=".MainActivity"
|
||||
android:launchMode="singleTask" />
|
||||
|
||||
<activity android:name=".view.ui.details.AppDetailsActivity"
|
||||
<activity android:name=".view.ui.details.EmptyAppDetailsActivity"
|
||||
android:noHistory="true"
|
||||
android:exported="true">
|
||||
<intent-filter>
|
||||
<action android:name="android.intent.action.VIEW" />
|
||||
@@ -119,6 +120,9 @@
|
||||
</intent-filter>
|
||||
</activity>
|
||||
|
||||
<activity android:name=".view.ui.details.AppDetailsActivity"
|
||||
android:exported="false">
|
||||
</activity>
|
||||
|
||||
<activity android:name=".view.ui.details.DevProfileActivity"
|
||||
android:exported="true">
|
||||
|
||||
@@ -229,11 +229,6 @@ class AppDetailsActivity : BaseDetailsActivity() {
|
||||
}
|
||||
fetchCompleteApp()
|
||||
}
|
||||
|
||||
intent.data?.let {
|
||||
autoDownload = it.getBooleanQueryParameter("download", false)
|
||||
downloadOnly = it.getBooleanQueryParameter("install", false)
|
||||
}
|
||||
} else {
|
||||
val rawApp: String? = intent.getStringExtra(Constants.STRING_EXTRA)
|
||||
if (rawApp != null) {
|
||||
|
||||
@@ -0,0 +1,33 @@
|
||||
package com.aurora.store.view.ui.details
|
||||
|
||||
import android.content.Intent
|
||||
import android.os.Bundle
|
||||
import androidx.appcompat.app.AppCompatActivity
|
||||
import com.aurora.extensions.close
|
||||
import com.aurora.store.R
|
||||
|
||||
class EmptyAppDetailsActivity: AppCompatActivity(R.layout.activity_details) {
|
||||
|
||||
override fun onCreate(savedInstanceState: Bundle?) {
|
||||
super.onCreate(savedInstanceState)
|
||||
onNewIntent(intent)
|
||||
}
|
||||
|
||||
override fun onNewIntent(intent: Intent?) {
|
||||
super.onNewIntent(intent)
|
||||
val validSchemes = listOf("market", "http", "https")
|
||||
|
||||
if (intent != null && validSchemes.any { it == intent.scheme }) {
|
||||
if (intent.data!!.getQueryParameter("id").isNullOrEmpty()) {
|
||||
close()
|
||||
} else {
|
||||
// Construct a new intent manually to avoid accepting extras from external apps
|
||||
Intent(this, AppDetailsActivity::class.java).also { extIntent ->
|
||||
extIntent.data = intent.data
|
||||
startActivity(extIntent)
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user