I have a question with regards to how to remedy intent redirection. I am not extremely well versed in Android, as the solutions offered on the Google Support page doesn't seem to address for flutter applications. I have noted that the question was asked before but wasn't explanatory
I have spent the last couple of days looking for a solution but each attempted solution on the support page fails when I reupload it to the play store. I've also contacted Google Support and they have validated that the vulnerability is still present.
Any help would be greatly appreciated thanks.
Some of the solution I have tried are:
1.
import io.flutter.embedding.android.FlutterActivity
import io.flutter.embedding.engine.FlutterEngine
import android.content.Intent
import android.os.Bundle
import androidx.annotation.RequiresApi
class MainActivity: FlutterActivity() {
#RequiresApi(Build.VERSION_CODES.O)
override fun configureFlutterEngine(#NonNull flutterEngine: FlutterEngine) {
super.configureFlutterEngine(flutterEngine)
if (callingActivity?.packageName.equals("known")) {
// val _intent = intent;
// // extract the nested Intent
// val forward:Intent = _intent.getParcelableExtra("key")
// // redirect the nested Intent
val _intent = intent;
// remove the grant URI permissions in the untrusted Intent
_intent.removeFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
_intent.removeFlags(Intent.FLAG_GRANT_WRITE_URI_PERMISSION);
// extract the nested Intent
var forward :Intent = _intent.getParcelableExtra("Key")!!
startActivity(forward);
}
// startActivity(_intent)
}
}
Setting android:export = false, crashes the app
<activity
android:name=".MainActivity"
android:exported="false"
android:launchMode="singleTop"
android:theme="#style/LaunchTheme"
android:configChanges="orientation|keyboardHidden|keyboard|screenSize|smallestScreenSize|locale|layoutDirection|fontScale|screenLayout|density|uiMode"
android:hardwareAccelerated="true"
android:windowSoftInputMode="adjustResize">
<!-- Specifies an Android theme to apply to this Activity as soon as
the Android process has started. This theme is visible to the user
while the Flutter UI initializes. After that, this theme continues
to determine the Window background behind the Flutter UI. -->
<meta-data
android:name="io.flutter.embedding.android.NormalTheme"
android:resource="#style/NormalTheme"
/>
<intent-filter>
<action android:name="android.intent.action.MAIN"/>
<category android:name="android.intent.category.LAUNCHER"/>
</intent-filter>
<intent-filter>
<action android:name="RECEIVE_DEFAULT" />
<category android:name="android.intent.category.DEFAULT"/>
</intent-filter>
</activity>
Edit:
I found the solution.
So [after reading carefully about intent vulnerability][1] I understood where my error was. The link above explains clearly on how untrusted intents can be used to exploit your application and access protected files. Google play tests your app bundle for this vulnerability by "intent injection". So removing the read and write flags from the intent helps prevent unauthorised access.
override fun onCreate(savedInstanceState: Bundle?) {
intent?.removeFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
intent?.removeFlags(Intent.FLAG_GRANT_WRITE_URI_PERMISSION)
super.onCreate(savedInstanceState)
}
This thus makes the intent "safe". I hope this helps everyone who encounters this issue. Happy coding
[1]: What is an Android PendingIntent?
Does anyone have links to sample code that shows how to set up heart sensor data retrieval directly from CanvasWatchFaceService or CanvasWatchFaceService.Engine ?
(Most of the code I've seen thus far perform sensor data retrieval from a wearable's Activity class, but not from a watch face environment.)
I've tried setting things up this way:
private class Engine extends CanvasWatchFaceService.Engine implements SensorEventListener {
...
... // implement interface methods
}
But I keep getting a null object for my sensor.
My manifest contains:
<uses-feature android:name="android.hardware.type.watch" />
<uses-permission android:name="android.permission.BODY_SENSORS" />
Check if you requested android.permission.BODY_SENSORS permission in your both mobile and wearable AndroidManifest.
Also, look into the logcat of your wearable device and grep for android.permission.BODY_SENSORS.
Background
I am developing a Cordova app that must run as a service, i.e. continue in the background and restart when the device does. As far as I can tell, on iOS it is just a case of setting the UIBackgroundModes correctly but on Android requires a little more effort and the service needs to be explicitly started.
I have developed a plugin for Android based on Mark Taylor's example here.
At present I have some JS called on deviceready to start the Android code but don't need to do anything for iOS.
Question
How should I package my plugin so that it will work on all platforms with zero config. It seems clunky to write if (Device.type == 'android') statements in my main JS but I don't really want to write native null implementations.
Is there a suggested approach for this?
Figured it out using the <js-module> tag described here.
Added this to my plugin.xml:
<platform name='android'>
...
<js-module src="androidSpecificStuff.js" name="SomeModule">
<clobbers target="SomeModule" />
</js-module>
...
</platform>
Then in androidSpecificStuff.js had code like:
document.addEventListener('deviceready', function () {
// do android-specific initialisation here
})
I'm new to mobile development. I'm using Phonegap/Cordova to create a cross-platform app. My code works well on Android but when I'm porting it to iPhone it's showing an error:
[143:2003] ERROR whitelist rejection: url="abc"
Now can I overcome this problem?
Notice: This answer only applies for PhoneGap version 1.x and below. From version 2.x onwards, whitelist configuration is done via cordova.xml.
You have to add allowed URLs into PhoneGap.plist's (or Cordova.plist) ExternalHosts array.
For example, if you want to allow access to this URL http://www.myhost.com/path/file, then add www.myhost.com as a new entry to ExternalHosts array.
If you want to allow access to content on all the subdomain of Google (e.g. maps.google.com, mails.google.com), you can add *.google.com as a new entry to ExternalHosts array.
I am not sure why you get "abc" in the link, though. Do you have "abc" as a link to anything? Is it URI fragment?
In PhoneGap 3.0, you need to edit config.xml in Project folder (note: not the www/config.xml)
<access origin="*" />
In PhoneGap 3.0, you need to edit www/config.xml, and add/edit <access> tags. For example, if you want to allow everything, change the tag to:
<access origin="*" />
You can add this following code in Cordova.plist file:
<key>ExternalHosts</key>
<array>
<string>*.facebook.com</string>
</array>
With *.facebook.com as the domain name, you can use two different sub-domains.
You will have to Domain Whitelist so you can access outside domains such as http://google.com.
In iOS (Cordova > 3.0.0), the whitelisting rules are found in AppName/config.xml and declared with the element <access origin="..." />
You can also use wildcards to declare domains. For example, to allow access to all subdomains and TLDs (.com, .net, etc) of Google, use *.google.*
Reference: Domain Whitelist Guide
Even I got the same issue... I fixed it in the below way..In cordova.plist--> under ExternalHosts array menu, add an item as * or .. So it allows all the external links... if u have to mention one by one mention it as .facebook.,*.google.* etc.
This is because phonegap won't take external urls .For phonegap older versions below 2.x we need to set url in cordova.plist like this.
ex:*.google.co.in(u can put your url after *. this) and OpenAllWhitelistURLsInWebView---to ---YES.
I'm trying to get some automated UI testing going on a GWT application and I'm having trouble finding a way to track UI elements.
For example, I have the following:
<g:Button text="Submit" ui:field="submitButton" enabled="true" />
which generates:
<button class="gwt-Button" type="button">Submit</button>
Its a compiler error to set both ui:field and id (id is considered deprecated anyway) so the problem is that I have no easy way to select my submit button using something like selenium.
Is anyone aware of a way I can map the
ui:field="sumbitButton"
to the generated HTML?
After further investigation I've discovered that you can enable debugIds which are ment for testing purposes. If you add:
<inherits name="com.google.gwt.user.Debug"/>
to your *.gwt.xml file you can then set debugId on your ui elements as such:
<g:Button text="Submit" ui:field="submitButton" enabled="true" debugId="submitButton"/>
and also in the codebehind by using the ensure debug id method
submitButton.ensureDebugId("submitButton");