Sanitize external intents properly

Also disable auto-download and installs from them

Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
This commit is contained in:
Aayush Gupta
2023-06-01 14:22:36 +08:00
parent 0a27b007d4
commit 1de331e5db
3 changed files with 38 additions and 6 deletions

View File

@@ -87,7 +87,8 @@
android:name=".MainActivity"
android:launchMode="singleTask" />
<activity android:name=".view.ui.details.AppDetailsActivity"
<activity android:name=".view.ui.details.EmptyAppDetailsActivity"
android:noHistory="true"
android:exported="true">
<intent-filter>
<action android:name="android.intent.action.VIEW" />
@@ -119,6 +120,9 @@
</intent-filter>
</activity>
<activity android:name=".view.ui.details.AppDetailsActivity"
android:exported="false">
</activity>
<activity android:name=".view.ui.details.DevProfileActivity"
android:exported="true">

View File

@@ -229,11 +229,6 @@ class AppDetailsActivity : BaseDetailsActivity() {
}
fetchCompleteApp()
}
intent.data?.let {
autoDownload = it.getBooleanQueryParameter("download", false)
downloadOnly = it.getBooleanQueryParameter("install", false)
}
} else {
val rawApp: String? = intent.getStringExtra(Constants.STRING_EXTRA)
if (rawApp != null) {

View File

@@ -0,0 +1,33 @@
package com.aurora.store.view.ui.details
import android.content.Intent
import android.os.Bundle
import androidx.appcompat.app.AppCompatActivity
import com.aurora.extensions.close
import com.aurora.store.R
class EmptyAppDetailsActivity: AppCompatActivity(R.layout.activity_details) {
override fun onCreate(savedInstanceState: Bundle?) {
super.onCreate(savedInstanceState)
onNewIntent(intent)
}
override fun onNewIntent(intent: Intent?) {
super.onNewIntent(intent)
val validSchemes = listOf("market", "http", "https")
if (intent != null && validSchemes.any { it == intent.scheme }) {
if (intent.data!!.getQueryParameter("id").isNullOrEmpty()) {
close()
} else {
// Construct a new intent manually to avoid accepting extras from external apps
Intent(this, AppDetailsActivity::class.java).also { extIntent ->
extIntent.data = intent.data
startActivity(extIntent)
}
}
}
}
}