INFOAdvisoryGuideline Security
AndroidSafety
AndroidSafetyUntrusted Intent Processing
Processing intents from untrusted sources without validation can lead to security vulnerabilities. This is especially critical in exported components.
Quick Fix
Always validate the data in incoming intents, especially those from exported components. Use checkCallingPermission() and validate intent data before processing.
What Gets Detected
Detection Type:CODE PATTERN
Patterns detected:
/getIntent\(\)\.get.*Extra.*startActivity//getIntent\(\)\.get.*Extra.*sendBroadcast//getSerializableExtra.*as\s+Intent//getParcelableExtra.*Intent::class//intent\.data.*startActivity//\bgetIntent\(\)[\s\S]{0,160}\b(getStringExtra|getParcelableExtra|getSerializableExtra)\b[\s\S]{0,200}\b(startActivity|sendBroadcast|setResult)\b/i/\bintent\.(getData|getStringExtra|getParcelableExtra)\b[\s\S]{0,200}\b(startActivity|sendBroadcast)\b/i