Develop Reference

Avoid malicious code to be sent to FirebaseDatabase via chat on Android

I'm working on an application that has a chat implemented with FirebaseDatabase, like the one shown in this codelab: https://codelabs.developers.google.com/codelabs/firebase-android/#0
The problem is: the user is free to send anything on chat, is it possible to block code like HTML or JS to be sent, to avoid security problems, or this can be treated only when reading messages sent?

On the user side you can remove HTML tags when submiting the message:
str = str.replaceAll("<(.*?)\\>", " ");//Removes all items in brackets
str = str.replaceAll("<(.*?)\\\n", " ");//Must be undeneath
str = str.replaceFirst("(.*?)\\>"," ");//Removes any connected item to the last bracket
str = str.replaceAll(" ", " ");
str = str.replaceAll("&", " ");
Also by default, most HTML tags won't be executed in your TextView unless you used fromHtml function.

I've done adding this method to the text sent via chat:
private fun removeHTMLCode(text: String?) = text?.replace("<[^>]*>".toRegex(), "")?.trim()

android: How to create an hyperlink to a code line using Log.d

I am learning logging in android code using android studio and emulator
I found that the following command shows a traceback with hyperlink to the code location
Log.d("TAG", "Message with stack trace info", new Throwable());
the image of logcat with hyperlink is
How can i create only the hyperlink part in my log message, without any traceback output

Try this, for example:
import android.util.Log;
public class Logger {
public static void log(String tag, String message) {
String caller = getCallerInfo(new Throwable().getStackTrace());
Log.d(tag, message + caller);
}
private static String getCallerInfo(StackTraceElement[] stacks) {
if (stacks == null || stacks.length < 1) {
return "";
}
StackTraceElement stack = stacks[1];
return String.format(" (%s:%s)", stack.getFileName(), stack.getLineNumber());
}
}
And call it from any where in your code
Logger.log("Manowar", "Today is the good day to die");

As of now the answer by #Cao Mạnh Quang was not giving me the Hyperlink.
The specific String format required for it's generation is this:
return String.format(" %s(%s:%s)", traceE.getClassName(), traceE.getFileName(), traceE.getLineNumber());
which is just the same as:
return stackTraceElement.toString();
so you may as well just do that.
Nothing was working for me...
My guess is that...
This hyperlink is generated by a preconfigured String specification format.
this format follows the className + "(" + fileName + ":" + lineNumber + ")"
If any of those parameters are missing, the hyperlink will not be generated.
There are a couple questions that arise from this:
Is this specification hard coded as a consensus of each LogCat display (IDE side interacts directly with String)
OR
Is this specification hardcoded into the Java code itself? (Java side interprets String generates hyperlink signal + IDE side interprets hyperlink signal and generates it)
The difference between which of these options is the one, would imply whether hyperlink generation is possible simply by changing the required configuration for the Logcat to generate the link either at IDE config level... OR at Java level.
Maybe it is not possible, and this configuration format cannot be changed....
Btw I am sure there must be some super hacky way to achieve this, maybe a way not so intuitive... or maybe it just requires some digging on the IDE config options...

SMS body text for html with % for percent sign crashes android app

Whenever I put a % in the body of my sms html link like:
sms (? or & separating depending on ios android) :
a href="sms:555555555?body=Hello123 % testing!"target="_parent">
Click /a
It crashes my messaging app on android, but on iOS it's fine. I tried to encode it as well, but that didn't seem to work. Any clue on how to escape this?
EDIT: This only happens with Google Messages, Samsung Messages is ok

try to write with symbol like ©<p>Copyright ©</p>

Try to encode percent like
a href="sms:555555555?body=Hello123 %25 testing!"target="_parent">

I had the same issue and spent a lot of time but solution was pretty simple.
Need to replace '%' with one of these:
percent sign variations
SMS body encoding function:
function encodeSMSText(text) {
const updatedText = text.replace(/%/g, String.fromCharCode(0xFF05));
return encodeURIComponent(updatedText)
.replace(/[!'()*]/g, function(c) {
return '%' + c.charCodeAt(0).toString(16);
});
}

Android, get JSON SMS

I send this jSON through SMS:
{"l":"-3","i":"1062","od":[{"l":"-3","i":"2448"},{"l":"-4","i":"2449"}]}
but I get this String through both shortMessage.getMessageBody() and shortMessage.getDisplayMessageBody():
"l":"-3","i":"1062","od": "l":"-3","i":"2448" , "l":"-4","i":"2449"
why JSON format broke and how to get the correct format?

Try to send like this...
"{""l":"-3","i":"1062","od":"[{""l":"-3","i":"2448""}","{""l":"-4","i":"2449""}]}"

Finally I found the problem !
The problem is about the device (in this case: Samsung galaxy note 10.1)
and the solution was using special characters instead of this four characters: {} [] so I replaced characters before sending SMS and then on device, replace them again. I used these characters:
! = {
# = }
# = [
% = ]

sendKeys - Send special characters

addressBar = (AutoCompleteTextView) mActivity.findViewById(package.R.id.addressBar);
TouchUtils.tapView(this, addressBar);
sendKeys("1"); //Works
sendKeys("G M A I L"); // Works - Result would be "gmail"
sendKeys("G M A I L . C O M"); // Doesn't work
sendKeys("{.}"); // Doesn't work
sendKeys("gmail") // Doesn't work
sendKeys("G M A I L {.} C O M") //Doesn't work
I am writing android test scripts using "InstrumentationTestCase2". I actually want to sendkeys - "gmail.com" but, unable to send special character "."(Dot)

For '.' (period or dot) you can try the int equivalent values of it.
Like,
sendKeys(56);
From Android-Docs
public static final int KEYCODE_PERIOD
Key code constant: '.' key.
Constant Value: 56 (0x00000038)

"The sequence of keys is a string containing the key names as specified in KeyEvent, without the KEYCODE_ prefix." (sendKeys documentation)
So you can use NUMPAD_DOT in the sendKeys string.
e.g.
sendKeys("G M A I L NUMPAD_DOT C O M");
For Further information see :
(http://developer.android.com/reference/android/test/InstrumentationTestCase.html#sendKeys(java.lang.String))

sendKeys(56); // for special character "." (Dot)

Have you tried the following:
getInstrumentation().sendStringSync("Do.You#Love.IT???");
works like magic and makes life a lot simpler!