signalapp/Signal-Android
signalapp/Signal-Android
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases 16 Wiki Activity

Improve validation on launcher alias intents.

Browse Source
This commit is contained in:
Greyson Parrelli 2026-06-05 19:43:58 +00:00 committed by Cody Henthorne
parent 96f893652b
commit a2a0b11c98
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
app/src/main/java/org/thoughtcrime/securesms/MainActivity.kt
View File

@ -1052,6 +1052,13 @@ class MainActivity :
private fun handleConversationIntent(intent: Intent) {
if (ConversationIntents.isConversationIntent(intent)) {
if (!isTrustedConversationIntent(intent)) {
Log.w(TAG, "Received a conversation intent through an exported entry point. Ignoring its extras.")
intent.action = null
setIntent(intent)
return
}
mainNavigationViewModel.goTo(MainNavigationListLocation.CHATS)
mainNavigationViewModel.goTo(MainNavigationDetailLocation.Conversation(ConversationIntents.readArgsFromBundle(intent.extras!!)))
intent.action = null
@ -1059,6 +1066,14 @@ class MainActivity :
}
}
/**
* While MainActivity isn't exporting, we have launcher aliases that are, so we verify that someone isn't launching us through those befre
* respecting various intent attributes.
*/
private fun isTrustedConversationIntent(intent: Intent): Boolean {
return intent.component?.className == MainActivity::class.java.name
}
private fun handleGroupLinkInIntent(intent: Intent) {
intent.data?.let { data ->
CommunicationActions.handlePotentialGroupLinkUrl(this, data.toString())