Avoid malicious code to be sent to FirebaseDatabase via chat on Android - android

I'm working on an application that has a chat implemented with FirebaseDatabase, like the one shown in this codelab: https://codelabs.developers.google.com/codelabs/firebase-android/#0
The problem is: the user is free to send anything on chat, is it possible to block code like HTML or JS to be sent, to avoid security problems, or this can be treated only when reading messages sent?

On the user side you can remove HTML tags when submiting the message:
str = str.replaceAll("<(.*?)\\>", " ");//Removes all items in brackets
str = str.replaceAll("<(.*?)\\\n", " ");//Must be undeneath
str = str.replaceFirst("(.*?)\\>"," ");//Removes any connected item to the last bracket
str = str.replaceAll(" ", " ");
str = str.replaceAll("&", " ");
Also by default, most HTML tags won't be executed in your TextView unless you used fromHtml function.

I've done adding this method to the text sent via chat:
private fun removeHTMLCode(text: String?) = text?.replace("<[^>]*>".toRegex(), "")?.trim()

Related

How to log on Fabrics a long message

I'm trying to write a long text log message on Fabrics system (Android), like this:
Answers.getInstance().logCustom(new CustomEvent("Request:" + requestUrl + "\nResponse:" + json));
The message become cut, and can't find a way to expand it:
Even when the message is added as a custom attribute, like #Alexizamerican suggested,
Answers.getInstance().logCustom(new CustomEvent("Requests"))
.putCustomAttribute("Request", requestUrl + "\nResponse:" + json)
it stays cut in the Events Dashboard, see picture below:
How to see the whole message?
It's best to include longer messages as custom attributes of an event, rather than in the event name. For example:
Answers.getInstance().logCustom(new CustomEvent("Requests"))
.putCustomAttribute("Request", requestUrl + "\nResponse:" + json)
Check out
https://docs.fabric.io/android/answers/answers-events.html#custom-attributes
for more details.

How to display properly formatted E-mail in TextView in android

I am working on an E-mail Application where I have to send and receive and also have to display email in TextView when ever user wants to read it
This is the feed I am getting from API :-
{
"messages":
[{"id":"136902",
"from":"Akash",
"email":"akash#email.com",
"subject":"mail App!!",
"message":"Hi Devraj,\n\n \n\nKindly provide sabmail apk for google play store.\n\n \n\nRegards,\n\nAkash",
"date":"1448870780",
"userid":"75",
"recipients":"devraj#mail.com ",
"status":"0",
"isread":"1",
"priority":"3",
"size":"3057"}
]}
I am taking the "message" tag and displaying it in TextView. It looks like this
Hi Devraj,Kindly provide mail apk for google play store.Regards,Akash,
But, I want it to be look like this,
Hi Devraj,
Kindly provide mail apk for google play store.
Regards,
Akash,
How can I do achieve this.
This is the way I am setting it in TextView
String msg = messageDisc.getMessage();
Spanned sp = Html.fromHtml(msg);
emailText.setText(sp);
emailText.setMovementMethod(LinkMovementMethod.getInstance());
Please let me know what mistake I am doing here.
Try to replace: \n with <br>.
String msg = messageDisc.getMessage();
msg = msg.replace("\n", "<br>");
Spanned sp = Html.fromHtml(msg);
Supply android:maxLines="<any number>" to the TextView. So that \n will work.
first parse the json data and stored it into a different String.
Then set the String object to the edittext by seperating it with a \n line.
eg: emailText.setText(sp+"" +\n+""+obj);

XMPP jid-malformed(400) error Android while creating user

I am trying to develop XMPP chat in Android and while creating new user using AccountManager I am having the following exception :
jid-malformed(400)
My user-connection code goes like this:
AccountManager manager = connection.getAccountManager();
try {
manager.createAccount(username, password);
}
catch(XMPPException e){
e..printStackTrace();
}
here my
username = abc#xyz.com
password = 12345678
I learned that we need not require to send service name with the username from post
But in my username the format says that my user is "abc" and my service is "xyz.com"
what should I do to keep '#' in my username?
Thank You. :)
JID escaping is done as per XEP-0106. Specifically, the "#" character should be replaced by "\40" to keep the "#" as part of the JID.

how to make a chat between two people with android socketio module on nodejs server?

I work to develop a chat app with android on node.js server.I made a simple chat app.But everyone gets involved in the same room.I want to make a chat between only two people.How can I do that? What information should I send to the server?such as sender_name,receiver_name,message as a json format.
-How can I to do list online-users?
-And How can I start a chat between only two people?
What are the requirements for it?
This might help:
I'd recommend setting up namespaces for each room you have your chat in. I did something similar in my own code. Note: Rooms and namespaces are a little different from each other in socket.io itself (socket.io has both: http://socket.io/docs/rooms-and-namespaces/).
In the Server code:
I have a method under socket.on('connection') that is similar to
socket.on('groupConnect', function(group){
var groupNsp = io.of('/' + group);
}
This essentially makes sure that a namespace is exists under the name of the desired one. It doesn't mess it up or reset the namespace when it is called again.
Then for receiving the messages:
socket.on('message', function(data){
var msg = data.msg;
var nsp = data.nsp;
io.of(nsp).emit('message', msg);
}
You could also add the nsp to the data you have already and then just send the data again to the clients.
Then, in the client code:
var socketOut = io.connect('http://yourdomain:1337/');
var someGroupOrMethodToGetGroup;
socketOut.emit('groupConnect', someGroupOrMethodToGetGroup);
var nsp;
setTimeout(function(){
socket = io.connect('http://yourdomain:1377/' + someGroupOrMethodToGetGroup);
socket.on('message', function(msg){
displayMessage(msg);
}
nsp = '/' + someGroupOrMethodToGetGroup;
}, 1500);
Then in my displayMessage code I have:
socketOut.emit('message', { msg: desiredMessage, nsp: nsp });
From another answer of mine (https://stackoverflow.com/a/24805494/3842050).

C2DM VB.Net code snippet returning Error=MissingRegistration

I am using the tutorial laid out here http://www.androidsnippets.com/vbnet-server-side-code-to-send-c2dm-messages to attempt to send a message to my device. I have requested a device ID and placed that string in the RegID String.
I receive a (what looks like a) GUID for the googleAuthToken successfully, but when the rest of the code executes, the response I get is Error=MissingRegistration. What exactly am I missing to implement C2DM from a server via VB.NET?
So, naturally as soon as I ask, the answer presents itself: durring the copying process
body += "collapse_key=nothing"
body += "&data.burst_id=" + "12345"
body += "&registration_id=" + RegID
became
body += "collapse_key=RDMS"
body += "&data.burst_id=" + "12345"
body += "&registration_id=" + RegID
So replacing the & with the standard & caused me to get a message id back.

Categories

Resources