Develop Reference

Avoid malicious code to be sent to FirebaseDatabase via chat on Android

I'm working on an application that has a chat implemented with FirebaseDatabase, like the one shown in this codelab: https://codelabs.developers.google.com/codelabs/firebase-android/#0
The problem is: the user is free to send anything on chat, is it possible to block code like HTML or JS to be sent, to avoid security problems, or this can be treated only when reading messages sent?

On the user side you can remove HTML tags when submiting the message:
str = str.replaceAll("<(.*?)\\>", " ");//Removes all items in brackets
str = str.replaceAll("<(.*?)\\\n", " ");//Must be undeneath
str = str.replaceFirst("(.*?)\\>"," ");//Removes any connected item to the last bracket
str = str.replaceAll(" ", " ");
str = str.replaceAll("&", " ");
Also by default, most HTML tags won't be executed in your TextView unless you used fromHtml function.

I've done adding this method to the text sent via chat:
private fun removeHTMLCode(text: String?) = text?.replace("<[^>]*>".toRegex(), "")?.trim()

android: How to create an hyperlink to a code line using Log.d

I am learning logging in android code using android studio and emulator
I found that the following command shows a traceback with hyperlink to the code location
Log.d("TAG", "Message with stack trace info", new Throwable());
the image of logcat with hyperlink is
How can i create only the hyperlink part in my log message, without any traceback output

Try this, for example:
import android.util.Log;
public class Logger {
public static void log(String tag, String message) {
String caller = getCallerInfo(new Throwable().getStackTrace());
Log.d(tag, message + caller);
}
private static String getCallerInfo(StackTraceElement[] stacks) {
if (stacks == null || stacks.length < 1) {
return "";
}
StackTraceElement stack = stacks[1];
return String.format(" (%s:%s)", stack.getFileName(), stack.getLineNumber());
}
}
And call it from any where in your code
Logger.log("Manowar", "Today is the good day to die");

As of now the answer by #Cao Mạnh Quang was not giving me the Hyperlink.
The specific String format required for it's generation is this:
return String.format(" %s(%s:%s)", traceE.getClassName(), traceE.getFileName(), traceE.getLineNumber());
which is just the same as:
return stackTraceElement.toString();
so you may as well just do that.
Nothing was working for me...
My guess is that...
This hyperlink is generated by a preconfigured String specification format.
this format follows the className + "(" + fileName + ":" + lineNumber + ")"
If any of those parameters are missing, the hyperlink will not be generated.
There are a couple questions that arise from this:
Is this specification hard coded as a consensus of each LogCat display (IDE side interacts directly with String)
OR
Is this specification hardcoded into the Java code itself? (Java side interprets String generates hyperlink signal + IDE side interprets hyperlink signal and generates it)
The difference between which of these options is the one, would imply whether hyperlink generation is possible simply by changing the required configuration for the Logcat to generate the link either at IDE config level... OR at Java level.
Maybe it is not possible, and this configuration format cannot be changed....
Btw I am sure there must be some super hacky way to achieve this, maybe a way not so intuitive... or maybe it just requires some digging on the IDE config options...

Html.fromHtml("message.") getting error android

i am getting an error when converting my message into html on run time.
according to my requirement, i am using this code
messageTextView.setText(Html.fromHtml((message2
) + "          " +
"       "));
for some space at runtime.but if message2 contain dot(.) in the last of message its showing as a clickable link so i used like this-
messageTextView.setText(message2+ Html.fromHtml(
" " + "          " +
"       "));
but its getting error in some devices.not showing any space at run time.How to resolved this?

ampersand in text message - sms sending android

So here's my problem.
I have a Timer which is supposed to send a SMS every X seconds.
And i want the text message to be the current GPS location of the user.
So, i want to send a kind of Google Maps URL, using the GPS coordinates i get, and adding some markers, maptype, size.... for the map.
To do that, i need to use the character "&" in the URL. In order to get something like that :
http://maps.googleapis.com/maps/api/staticmap?center=40.714728,-73.998672&zoom=12&size=400x400&maptype=roadmap
(ie : https://developers.google.com/maps/documentation/staticmaps/?csw=1#URL_Parameters)
But, when i want to use this kind of URL, using "&" in my text message of the SMS. The SMS is never sent. When i remove every part containing the "&", it's working fine.
I tried to use "&amp ;" instead of "&". Still doesn't work.
Here's my SMS manager to send the SMS :
smsManager.sendTextMessage(INT, null, "Alert - RED AREA \n TIME : " + current date + " \n Lat: " + latitude + " \n Long: " + longitude + "Link Maps : http://maps.googleapis.com/maps/api/staticmap?center=" + latitude + "," + longitude +"&zoom=12&size=400x400&maptype=satellite", null, null);
The code above, doesn't send any messages.
But this one does :
smsManager.sendTextMessage(INT, null, "Alert - RED AREA \n TIME : " + current date + " \n Lat: " + latitude + " \n Long: " + longitude + "Link Maps : http://maps.googleapis.com/maps/api/staticmap?center=" + latitude + "," + longitude, null, null);
Any ideas ?
Thanks !

Use "%26" instead of "&" or "&amp", the URL will still parse and the SMS will construct properly

The simplest solution would be to think of some sort of special character (or string) that you would use to replace the '&' character in your string.
You would go through your source string and replace every occurence of '&' with the special string (representing '&').
The reversed mechanism should be implemented in the receving side.
BUT BE CAREFUL! you need to choose your special string carefully! Because if you choose a string that could normally occur in your source string, the receiver would insert a fake '&' characters.
If this solution is not good enough, let me know... I have had a similar problem in one of my apps, and found a workaround without replacing a character with something else.

C2DM VB.Net code snippet returning Error=MissingRegistration

I am using the tutorial laid out here http://www.androidsnippets.com/vbnet-server-side-code-to-send-c2dm-messages to attempt to send a message to my device. I have requested a device ID and placed that string in the RegID String.
I receive a (what looks like a) GUID for the googleAuthToken successfully, but when the rest of the code executes, the response I get is Error=MissingRegistration. What exactly am I missing to implement C2DM from a server via VB.NET?

So, naturally as soon as I ask, the answer presents itself: durring the copying process
body += "collapse_key=nothing"
body += "&data.burst_id=" + "12345"
body += "&registration_id=" + RegID
became
body += "collapse_key=RDMS"
body += "&data.burst_id=" + "12345"
body += "&registration_id=" + RegID
So replacing the & with the standard & caused me to get a message id back.