Skip to content

Fix StrictMode unsafe intent launch violation #2330

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

nift4
Copy link

@nift4 nift4 commented Apr 11, 2025

No description provided.

@tonihei
Copy link
Collaborator

tonihei commented Apr 17, 2025

Could you provide more details on what the issue is? I don't see any warnings/lint issues in this area in Android Studio, but it sounds like you've seen a warning using some StrictMode.

@tonihei tonihei assigned tonihei and unassigned tonihei Apr 17, 2025
@nift4
Copy link
Author

nift4 commented Apr 17, 2025

Hi @tonihei ,

in debug builds of my app I enabled the built-in platform feature StrictMode with the VmPolicy set to (among others) detect unsafe intent launches:
https://developer.android.com/reference/android/os/StrictMode.VmPolicy.Builder#detectUnsafeIntentLaunch()
with penaltyDeath (the app process will be terminated when an issue occurs). This helps catch programming mistakes.

One such issue detected by StrictMode is that when starting playback with a wired headset's play button using media resumption, the MediaButtonRetriever takes the recieved Intent, modifies it and sends it again. According to the docs, this is a possible security problem:
https://developer.android.com/reference/android/os/strictmode/UnsafeIntentLaunchViolation
However, in this case, because setComponent() is always set to our own app's component, there is no security impact at all. I still believe it's good to fix this, because it's technically not a false positive (the Intent with which the service is started does originate from another app).

And fixing this will allow me to remove the exemption of this detection from penaltyDeath and hence detect other programming mistakes that might be a real issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants