From 1de331e5dbd59d67b25fe869123c9a01a24b3e0f Mon Sep 17 00:00:00 2001
From: Aayush Gupta <aayushgupta219@gmail.com>
Date: Thu, 1 Jun 2023 14:22:36 +0800
Subject: [PATCH] Sanitize external intents properly

Also disable auto-download and installs from them

Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
---
 app/src/main/AndroidManifest.xml              |  6 +++-
 .../view/ui/details/AppDetailsActivity.kt     |  5 ---
 .../ui/details/EmptyAppDetailsActivity.kt     | 33 +++++++++++++++++++
 3 files changed, 38 insertions(+), 6 deletions(-)
 create mode 100644 app/src/main/java/com/aurora/store/view/ui/details/EmptyAppDetailsActivity.kt

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index b3625519c..9351e2ebb 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -87,7 +87,8 @@
             android:name=".MainActivity"
             android:launchMode="singleTask" />
 
-        <activity android:name=".view.ui.details.AppDetailsActivity"
+        <activity android:name=".view.ui.details.EmptyAppDetailsActivity"
+            android:noHistory="true"
             android:exported="true">
             <intent-filter>
                 <action android:name="android.intent.action.VIEW" />
@@ -119,6 +120,9 @@
             </intent-filter>
         </activity>
 
+        <activity android:name=".view.ui.details.AppDetailsActivity"
+            android:exported="false">
+        </activity>
 
         <activity android:name=".view.ui.details.DevProfileActivity"
             android:exported="true">
diff --git a/app/src/main/java/com/aurora/store/view/ui/details/AppDetailsActivity.kt b/app/src/main/java/com/aurora/store/view/ui/details/AppDetailsActivity.kt
index 3a1ca5996..39b5f59ac 100644
--- a/app/src/main/java/com/aurora/store/view/ui/details/AppDetailsActivity.kt
+++ b/app/src/main/java/com/aurora/store/view/ui/details/AppDetailsActivity.kt
@@ -229,11 +229,6 @@ class AppDetailsActivity : BaseDetailsActivity() {
                 }
                 fetchCompleteApp()
             }
-
-            intent.data?.let {
-                autoDownload = it.getBooleanQueryParameter("download", false)
-                downloadOnly = it.getBooleanQueryParameter("install", false)
-            }
         } else {
             val rawApp: String? = intent.getStringExtra(Constants.STRING_EXTRA)
             if (rawApp != null) {
diff --git a/app/src/main/java/com/aurora/store/view/ui/details/EmptyAppDetailsActivity.kt b/app/src/main/java/com/aurora/store/view/ui/details/EmptyAppDetailsActivity.kt
new file mode 100644
index 000000000..287b9be6d
--- /dev/null
+++ b/app/src/main/java/com/aurora/store/view/ui/details/EmptyAppDetailsActivity.kt
@@ -0,0 +1,33 @@
+package com.aurora.store.view.ui.details
+
+import android.content.Intent
+import android.os.Bundle
+import androidx.appcompat.app.AppCompatActivity
+import com.aurora.extensions.close
+import com.aurora.store.R
+
+class EmptyAppDetailsActivity: AppCompatActivity(R.layout.activity_details) {
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        onNewIntent(intent)
+    }
+
+    override fun onNewIntent(intent: Intent?) {
+        super.onNewIntent(intent)
+        val validSchemes = listOf("market", "http", "https")
+
+        if (intent != null && validSchemes.any { it == intent.scheme }) {
+            if (intent.data!!.getQueryParameter("id").isNullOrEmpty()) {
+                close()
+            } else {
+                // Construct a new intent manually to avoid accepting extras from external apps
+                Intent(this, AppDetailsActivity::class.java).also { extIntent ->
+                    extIntent.data = intent.data
+                    startActivity(extIntent)
+                }
+            }
+
+        }
+    }
+}