Develop Reference

Android Your app(s) are vulnerable to Intent Redirection

I got an email from google play support saying "Intent Redirection Your app(s) are vulnerable to Intent Redirection. To address this issue, follow the steps in this Google Help Center article."
After reading through the article, I'm guessing the key is my app should not call startActivity, startService, sendBroadcast, or setResult on untrusted Intents (intents used by external apps to invoke my app for example) without validating or sanitizing these Intents.
However, solution 1 in the article doesn't work in my case because my component needs to receive Intents from other apps.
Solution 2 is not applicable to my case because I don't know in advance which app would invoke my app, so I don't know what would getCallingActivity returns.
Solution 3 seems to be the most promising one, I tried to removeFlags of intents, however, when I resubmit my app, Google Play again alerts this vulnerability. I am about to try checking whether an Intent grants a URI permission using methods like getFlags and submit my app again to see the result. Does anyone know how do Google check this vulnerability anyway, and could someone spot the vulnerability in my source code and suggest a way to resolve it?
The exact message from Google Play is
Intent Redirection
Your app(s) are vulnerable to Intent Redirection.
To address this issue, follow the steps in this Google Help Center article.
com.mydomain.somepackage.a->a
And the following is the simplified source code.
// MainActivity.java
public class MainActivity extends CordovaActivity
{
SpecialUtil specialUtil;
#Override
public void onCreate(Bundle savedInstanceState)
{
super.onCreate(savedInstanceState);
specialUtil = new specialUtil(MainActivity.this);
}
#Override
public void onResume() {
super.onResume();
specialUtil.verifyServerIfNeeded(MainActivity.this);
}
#Override
protected void onActivityResult(int requestCode, int resultCode, Intent data) {
super.onActivityResult(requestCode, resultCode, data);
if (requestCode == this.specialUtil.CERT_INVALID_POPUP_REQUEST_CODE) {
// the user clicked the return button in the alert dialog within WhiteScreen activity
this.specialUtil.declareAsFailure();
}
}
#Override
protected void onNewIntent(Intent intent) {
super.onNewIntent(intent);
setIntent(intent);
}
}
// com/mydomain/somepackage/SpecialUtil.java
public class SpecialUtil {
private SharedPreferences mSharedPreferences;
private SharedPreferences.Editor mSharedPreferencesEditor;
private SharedPreferences.OnSharedPreferenceChangeListener listener;
private Activity activity;
private boolean shownCertInvalidPopup = false;
public final int CERT_INVALID_POPUP_REQUEST_CODE = 1000;
public SpecialUtil(Activity activity) {
this.activity = activity;
this.mSharedPreferences = PreferenceManager.getDefaultSharedPreferences(activity);
this.mSharedPreferencesEditor = mSharedPreferences.edit();
this.listener = new SharedPreferences.OnSharedPreferenceChangeListener() {
#Override
public void onSharedPreferenceChanged(SharedPreferences sharedPreferences, String key) {
if (key.equals("SOME_RESULT")) {
String result = mSharedPreferences.getString("SOME_RESULT", "");
if (result.equals("RESULT_OK")) {
SpecialUtil.this.declareAsSuccess();
} else if (result.equals("RESULT_CANCELED")) {
SpecialUtil.this.declareAsFailure();
}
}
}
};
this.mSharedPreferences.registerOnSharedPreferenceChangeListener(listener);
}
public void verifyServerIfNeeded(Activity activity) {
Intent intent = activity.getIntent();
if (this.isFlowA(intent)) {
this.removePermission(intent);
String url = intent.getStringExtra("url");
this.verifyServer(url);
} else if (this.isFlowB(intent)) {
this.removePermission(intent);
String payment_request_object_url = intent.getData().getQueryParameter("pay_req_obj");
String callback_url = intent.getData().getQueryParameter("callback");
this.verifyServer(payment_request_object_url);
}
}
public boolean isFlowA(Intent intent) {
if (intent.getAction().equals("someAction")) {
return true;
}
return false;
}
public boolean isFlowB(Intent intent) {
if (intent.getData() != null) {
String path = intent.getData().getPath();
if (path.equals("something")) {
return true;
}
}
return false;
}
public void verifyServer(final String httpsURL) {
new Thread(new Runnable() {
#Override
public void run() {
try {
boolean isCertValid = SpecialUtil.this.verify(httpsURL);
if (isCertValid) {
// do somthing
} else {
// show a white screen with an alert msg
SpecialUtil.this.activity.runOnUiThread(new Runnable() {
public void run() {
if (!shownCertInvalidPopup) {
shownCertInvalidPopup = true;
Intent intent = new Intent(SpecialUtil.this.activity, WhiteScreen.class);
SpecialUtil.this.activity.startActivityForResult(intent, CERT_INVALID_POPUP_REQUEST_CODE);
}
}
});
}
} catch (IOException e) {
SpecialUtil.this.declareAsFailure();
}
}
}).start();
}
private void declareAsSuccess() {
this.activity.setResult(Activity.RESULT_OK, SpecialUtil.this.activity.getIntent());
this.activity.finishAndRemoveTask();
}
public void declareAsFailure() {
this.activity.setResult(Activity.RESULT_CANCELED, this.activity.getIntent());
this.activity.finishAndRemoveTask();
}
private void removePermission(Intent intent) {
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
intent.removeFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
intent.removeFlags(Intent.FLAG_GRANT_WRITE_URI_PERMISSION);
}
}
}
// com/mydomain/somepackage/WhiteScreen.java
public class WhiteScreen extends Activity {
SpecialUtil specialUtil;
#Override
public void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
specialUtil = new SpecialUtil(WhiteScreen.this);
String title = "someTitle";
final AlertDialog.Builder builder = new AlertDialog.Builder(WhiteScreen.this)
.setTitle(title)
.setPositiveButton(btn_text, new DialogInterface.OnClickListener() {
public void onClick(DialogInterface dialog, int which) {
// Don't start the process, quit App immediately
WhiteScreen.this.setResult(Activity.RESULT_CANCELED, WhiteScreen.this.getIntent());
WhiteScreen.this.finishAndRemoveTask();
}
});
AlertDialog alertDialog = builder.create();
alertDialog.show();
}
}

Append Firebase Token to start URL -Trusted Web Activity

I would like to pass FCM token in the start url. My code doesnt work everytime, i think needs a delay but i cant handle it.
Below code doesnt work every time because sometimes the TWA launches before the firebase connection has been made:
public class LauncherActivity
extends com.google.androidbrowserhelper.trusted.LauncherActivity {
public static String x = null;
#override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
//RegisterToTopic for FCM
FirebaseMessaging.getInstance().subscribeToTopic("all");
FirebaseMessaging.getInstance().getToken()
.addOnCompleteListener(new OnCompleteListener() {
#override
public void onComplete(#nonnull Task task) {
// Get new FCM registration token
x = task.getResult();
}
});
}
#Override
protected Uri getLaunchingUrl() {
// Get the original launch Url.
Uri uri = super.getLaunchingUrl();
// Append the extra parameter to the launch Url
return uri
.buildUpon()
.appendQueryParameter("z", String.valueOf(x))
.build();
}
}
I have also tried this but the same result:
public class StartActivity extends AppCompatActivity {
final long SPLASH_DELAY = 4000;
public static String x = null;
#Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.activity_splash);
runMainApp();
FirebaseMessaging.getInstance().getToken()
.addOnCompleteListener(new OnCompleteListener<String>() {
#Override
public void onComplete(#NonNull Task<String> task) {
// Get new FCM registration token
x = task.getResult();
Intent intent = new Intent(getBaseContext(), CustomLauncherActivity.class);
intent.putExtra("EXTRA_SESSION_ID", x);
startActivity(intent);
}
});
}
private void runMainApp() {
new Handler().postDelayed(() -> {
startActivity(new Intent(SplashActivity.this, CustomLauncherActivity.class)
.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_CLEAR_TASK));
finish();
overridePendingTransition(R.anim.anim_right_in, R.anim.anim_left_out);
}, SPLASH_DELAY);
}
}
I have received an answer from android-browser-helper repo but i cant handel it. If someone could provide more help would be much appreciated.
public class MyLauncherActivity extends LauncherActivity {
private static class DelayedTwaLauncher extends TwaLauncher {
#Override
public void launch(TrustedWebActivityIntentBuilder twaBuilder,
CustomTabsCallback customTabsCallback,
#Nullable SplashScreenStrategy splashScreenStrategy,
#Nullable Runnable completionCallback,
FallbackStrategy fallbackStrategy) {
if (firebase has finished loading) {
super.launch(twaBuilder, customTabsCallback, splashScreenStrategy, fallbackStrategy);
} else {
// Save the parameters to some variables.
// Don't do anything else.
}
}
public void actuallyLaunch() {
if (we didn't call super.launch before) {
super.launch(the parameters you saved before);
}
}
#Override
protected TwaLauncher createTwaLauncher() {
return delayedTwaLauncher;
}
}

Starting with android-browser-helper] v2.2.0, it's possible to run asynchronous code before in the LauncherActivity before launching the Trusted Web Activity.
This is how a custom LauncherActivity for Firebase Analytics looks like:
public class FirebaseAnalyticsLauncherActivity extends LauncherActivity {
private String mAppInstanceId;
#Override
protected void onCreate(#Nullable Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
FirebaseAnalytics firebaseAnalytics = FirebaseAnalytics.getInstance(this);
// Start the asynchronous task to get the Firebase application instance id.
firebaseAnalytics.getAppInstanceId().addOnCompleteListener(task -> {
// Once the task is complete, save the instance id so it can be used by
// getLaunchingUrl().
mAppInstanceId = task.getResult();
launchTwa();
});
}
#Override
protected boolean shouldLaunchImmediately() {
// launchImmediately() returns `false` so we can wait until Firebase Analytics is ready
// and then launch the Trusted Web Activity with `launch()`.
return false;
}
#Override
protected Uri getLaunchingUrl() {
Uri uri = super.getLaunchingUrl();
// Attach the Firebase instance Id to the launchUrl. This example uses "appInstanceId" as
// the parameter name.
return uri.buildUpon()
.appendQueryParameter("appInstanceId", mAppInstanceId)
.build();
}
}
Check out the full Firebase Analytics demo here.

Braintree PayPal Sandbox keeps redirecting

I have added a simple non drop-in paypal integration in sandbox mode to my app. Here is a test activity with a single "Pay" button:
public class PaypalPaymentAcivity extends Activity implements PaymentMethodNonceCreatedListener {
private BraintreeFragment mBraintreeFragment;
#Override
protected void onCreate(#Nullable Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.activity_paypal);
findViewById(R.id.payButton).setOnClickListener(new View.OnClickListener() {
#Override
public void onClick(View v) {
startPayment();
}
});
}
private void startPayment() {
try {
mBraintreeFragment = BraintreeFragment.newInstance(this, "...");
PayPalRequest request = new PayPalRequest("1")
.currencyCode("USD")
.intent(PayPalRequest.INTENT_AUTHORIZE);
PayPal.requestOneTimePayment(mBraintreeFragment, request);
} catch (InvalidArgumentException e) {
e.printStackTrace();
}
}
#Override
public void onPaymentMethodNonceCreated(PaymentMethodNonce paymentMethodNonce) {
}
}
However once the PayPal browser window comes up after clicking the buttons it just keeps popping up over and over, and never returns to my activity.
Anyone had a successful integration like this?

`CalledFromWrongThreadException` when calling QBChatService.login() method in QuickBlox API

I'm developing an IM app using the Quickblox API and I'm currently developing the Sign Up and Login features. Well, my problem is that everytime I try to login to the QBChatService by calling QBChatService.login() I'm getting this error from Log Cat:
E/Event: Could not dispatch event: class regmoraes.jusstalk.session.SessionEvents to subscribing class class regmoraes.jusstalk.session.LoginPresenter
E/Event: android.view.ViewRootImpl$CalledFromWrongThreadException: Only the original thread that created a view hierarchy can touch its views.
I'm using MVP pattern and EventBus to send events from Models ( I called them Managers) to Presenters.
Here are my classes (interaction order between them at the end):
LoginActivity:
public class LoginActivity extends Activity implements LoginView, View.OnClickListener{
private AutoCompleteTextView mUserField;
private EditText mPasswordField;
private TextView mSignUpTextView;
private Button mLoginButton;
private ProgressBar mProgressBar;
private LoginUIPresenter loginPresenter;
#Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.activity_login);
mProgressBar = (ProgressBar) findViewById(R.id.login_progress);
mUserField = (AutoCompleteTextView) findViewById(R.id.email);
mPasswordField = (EditText) findViewById(R.id.password);
mLoginButton = (Button) findViewById(R.id.button_sign_in);
mLoginButton.setOnClickListener(this);
mSignUpTextView = (TextView) findViewById(R.id.textView_sign_up);
mSignUpTextView.setOnClickListener(this);
this.loginPresenter = new LoginPresenter(this);
}
#Override
public void showMessageDialog(List errors) {
AlertDialog.Builder dialog = new AlertDialog.Builder(this);
dialog.setMessage("chat login errors: " + errors).create().show();
}
#Override
public void startNewActivity(Class activity) {
Intent mIntent = new Intent(this, activity);
startActivity(mIntent);
finish();
}
#Override
public void showProgress(boolean show) {
if(show){
mProgressBar.setVisibility(View.VISIBLE);
mUserField.setVisibility(View.INVISIBLE);
mPasswordField.setVisibility(View.INVISIBLE);
mLoginButton.setVisibility(View.INVISIBLE);
}else{
mProgressBar.setVisibility(View.GONE);
mUserField.setVisibility(View.VISIBLE);
mPasswordField.setVisibility(View.VISIBLE);
}
}
#Override
public void onClick(View v) {
switch(v.getId()){
case R.id.button_sign_in:
loginPresenter.login(mUserField.getText().toString(),
mPasswordField.getText().toString());
break;
case R.id.textView_sign_up:
startNewActivity(SignUpActivity.class);
}
}
#Override
public void showToast(String message, int length) {
Toast.makeText(this, message,length).show();
}
}
LoginPresenter:
public class LoginPresenter implements LoginUIPresenter{
LoginView loginView;
SessionManager sessionManager;
public LoginPresenter(LoginView loginView) {
EventBus.getDefault().register(this);
/*...*/
}
#Override
public void login(String username, String password) {
loginView.showProgress(true);
sessionManager.login(username,password);
}
public void onEvent(SessionEvents sessionEvents){
switch (sessionEvents.getEvent()){
case SessionEvents.LOGIN_SUCCESSFULL:
sessionManager.loginToChatService();
break;
case SessionEvents.LOGIN_FAILED:
loginView.showProgress(false);
loginView.showToast("Problem when connecting", Toast.LENGTH_SHORT);
break;
case SessionEvents.CHAT_SERVICE_CONNECTED:
loginView.startNewActivity(MainActivity.class);
break;
default:break;
}
}
}
SessionManager:
public class SessionManagement implements SessionManager,ConnectionListener {
private String TAG = SessionManagement.class.getName();
private SharedPreferences mSharedPreferences;
private Context mContext;
private SessionEvents sessionEvents;
private QBUser currentUser;
public QBChatService qbChatService;
public SessionManagement(Context context) {
this.mContext = context;
this.mSharedPreferences = (mContext)
.getSharedPreferences("regmoraes.testapp", Context.MODE_PRIVATE);
initChatServiceIfNeeded();
this.sessionEvents = new SessionEvents();
this.qbChatService = QBChatService.getInstance();
}
/* .... */
private void initChatServiceIfNeeded() {
if (!QBChatService.isInitialized()) {
QBChatService.setDebugEnabled(true);
QBChatService.init(mContext);
QBChatService.getInstance().addConnectionListener(this);
}
}
#Override
public void login(final String username, final String password) {
final QBUser qbUser = new QBUser(username,password);
QBAuth.createSession(qbUser, new QBEntityCallbackImpl<QBSession>() {
#Override
public void onSuccess(QBSession qbSession, Bundle params) {
currentUser = qbUser;
currentUser.setId(qbSession.getId());
saveCredentials(currentUser.getLogin(), currentUser.getPassword());
sessionEvents.setEvent(SessionEvents.LOGIN_SUCCESSFULL);
EventBus.getDefault().post(sessionEvents);
}
#Override
public void onError(List<String> errors) {
sessionEvents.setEvent(SessionEvents.LOGIN_FAILED);
EventBus.getDefault().post(sessionEvents);
}
});
}
#Override
public void loginToChatService(){
qbChatService.login(currentUser, new QBEntityCallbackImpl() {
#Override
public void onSuccess() {
try {
qbChatService.startAutoSendPresence(30);
sessionEvents.setEvent(SessionEvents.CHAT_SERVICE_CONNECTED);
EventBus.getDefault().post(sessionEvents);
} catch (SmackException.NotLoggedInException e) {
e.printStackTrace();
}
}
#Override
public void onError(List errors) {
sessionEvents.setEvent(SessionEvents.LOGIN_FAILED);
EventBus.getDefault().post(sessionEvents);
}
});
}
}
This is how my classes interacts when user want to login:
User click on Sign In button in LoginActivity
LoginActivity calls LoginPresenter.signIn()
LoginPresenter calls SessionManager.login()
SessionManager send event LOGIN_SUCESSFULL to LoginPresenter
LoginPresenter calls SessionManager.loginToChatService()
ERROR
I know that the error is because of a Background Thread calling a UI Thread method, but the login method works well, only the loginToChat method that throws this error.
How could I fix this?
Thanks

As #logcat said:
It seems like the onEvent method is triggered by a background thread, unlike Android UI events which are already called on the UI thread for you.
And he was right, the onEvent method was triggered by the SessionManager.loginToChat() method, so to fix this, I had to make the onEvent be triggered on UI thread.
After searching the EvenBus Doc I saw this at the Delivery Threads and Threadmodes section:
EventBus can handle threading for you: events can be posted in threads different from the posting thread. (...)
In EventBus, you may define the thread that will call the event handling method onEvent by using a ThreadMode (...)
MainThread: Subscriber will be called in Android's main thread (sometimes referred to as UI thread). If the posting thread is the main thread, event handler methods will be called directly. Event handlers using this mode must return quickly to avoid blocking the main thread. Example:
// Called in Android UI's main thread
public void onEventMainThread(MessageEvent event) {
textField.setText(event.message);
}
So, what I had to do was to change the onEvent method of LoginPresenter to onEventMainThread! In that way, the LoginPresenter can handle the received event on UI thread.

Inside your loginToChatService() method, try to put the code of the login call inside a runOnUiThread call like this:
activity.runOnUiThread(new Runnable() {
#Override
public void run() {
qbChatService.login(currentUser, new QBEntityCallbackImpl() {
...
}
});
activity should be an instance of Activity (could be this, depending on where your code is located).

Scringo: openChat function doesn't work

I am using the library scringo on Android. "openChat" function doesn't seem to be working. It does absolutely nothing. Here is my code.
I read through their API:
http://www.scringo.com/docs/api/android/
openChat function should open the 1-on-1 chat with the other user. But that doesnt happen. Nothing happens. All the other functions are working fine.
It doesn't even log any errors or warning.
public class MainActivity extends Activity implements OnClickListener {
private Scringo scringo;
private Activity mainactivity;
private Button button;
#Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
mainactivity = this;
setContentView(R.layout.activity_main);
button = (Button) findViewById(R.id.button);
button.setOnClickListener(this);
Scringo.setAppId("MY-APP-ID");
Scringo.setDebugMode(true);
scringo = new Scringo(this);
scringo.init();
scringo.addSidebar();
Scringo.loginWithEmail("a#testapp.com", "hi", new ScringoSignUpListener(){
#Override
public void onError(String arg0) {
}
#Override
public void onSuccess(String arg0) {
Log.w("user",Scringo.getUserId());
}
});
}
#Override
public void onClick(View arg0) {
//I am using the ID of another user.
//This does not work. Nothing happens. No error or warning either.
Scringo.openChat(this, "Qk8vJs4fRE");
//This works fine.
//Scringo.openChatRooms(this);
}
}

You should call the openChat after getting the user:
Scringo.getUserByScringoId("SOME_ID...", new ScringoGetUserListener() {
#Override
public void gotUser(ScringoUser user) {
Scringo.openChat(MainActivity.this, "SOME_ID...");
}
});