收到来自谷歌的邮件说“您的应用程序容易受到 Intent 重定向”。我能做些什么？答案

【问题标题】：Got a mail from google saying "Your app(s) are vulnerable to Intent Redirection". What can I do?收到来自谷歌的邮件说“您的应用程序容易受到 Intent 重定向”。我能做些什么？
【发布时间】：2021-09-30 14:03:57
【问题描述】：

以下是我使用的依赖项。我的依赖项是否有任何漏洞...我已按照他们提供的指南进行操作，但仍被拒绝

dependencies {
    implementation fileTree(dir: 'libs', include: ['*.jar'])
    implementation 'androidx.appcompat:appcompat:1.3.1'
    implementation 'androidx.constraintlayout:constraintlayout:2.1.0'
    implementation 'androidx.navigation:navigation-fragment:2.3.5'
    implementation 'androidx.navigation:navigation-ui:2.3.5'
    implementation 'androidx.legacy:legacy-support-v4:1.0.0'
    implementation 'androidx.cardview:cardview:1.0.0'
    testImplementation 'junit:junit:4.13.2'
    androidTestImplementation 'androidx.test.ext:junit:1.1.3'
    androidTestImplementation 'androidx.test.espresso:espresso-core:3.4.0'

    ADDITIONAL LIBRARIES
    implementation 'androidx.cardview:cardview:1.0.0'
    implementation 'com.google.android.material:material:1.4.0'
    implementation 'com.google.android.gms:play-services-location:18.0.0'
    implementation 'com.google.android.gms:play-services-maps:17.0.1'
    implementation 'com.google.android.gms:play-services-auth:19.2.0'
    implementation 'com.google.android.gms:play-services-auth-api-phone:17.5.1'

    implementation 'com.rengwuxian.materialedittext:library:2.1.4'
    implementation 'com.github.GrenderG:Toasty:1.4.2'
    //implementation 'com.koushikdutta.ion:ion:2.2.1'
    implementation 'com.koushikdutta.ion:ion:3.1.0'

    implementation 'androidx.recyclerview:recyclerview:1.2.1'
    implementation 'de.hdodenhof:circleimageview:3.1.0'

    implementation 'com.squareup.picasso:picasso:2.71828'
    implementation 'gun0912.ted:tedpermission:2.2.3'
    implementation 'com.tapadoo.android:alerter:6.1.0'
    implementation 'com.github.chrisbanes:PhotoView:2.3.0'
    implementation 'com.github.ganfra:material-spinner:2.0.0'
    implementation 'com.pierfrancescosoffritti.androidyoutubeplayer:core:10.0.5'

    implementation 'com.github.bumptech.glide:glide:4.11.0'
    annotationProcessor 'com.github.bumptech.glide:compiler:4.11.0'
    implementation 'com.android.volley:volley:1.2.0' }

下面显示了所有help-center 建议，我已添加“android:exported="false"” 我的清单文件，但该应用程序仍然被拒绝。我有很多活动。而且我有很多“startActivity()”，我还从应用程序中打开了 GoogleMap 和 YouTube，这会导致问题吗？我也在使用已经折旧的“startActivityForResult()”，是否也会导致问题？

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools"
    package="com.give.android_fisheries_2">
    <!--
         The ACCESS_COARSE/FINE_LOCATION permissions are not required to use
         Google Maps Android API v2, but you must specify either coarse or fine
         location permissions for the "MyLocation" functionality.
    -->
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
    <uses-permission android:name="android.permission.CALL_PHONE" />

    <uses-feature
        android:name="android.hardware.camera"
        android:required="true"
        />

    <supports-screens
        android:anyDensity="true"
        android:largeScreens="true"
        android:normalScreens="true"
        android:smallScreens="true"
        android:xlargeScreens="true" />

    <application
        android:allowBackup="true"
        android:hardwareAccelerated="true"
        android:icon="@mipmap/app_icon_update_larger"
        android:label="@string/app_name"
        android:largeHeap="true"
        android:roundIcon="@mipmap/app_icon_update_larger_round"
        android:supportsRtl="true"
        android:theme="@style/AppTheme"

        android:usesCleartextTraffic="true">

        <activity android:name=".tutorial.TutorialMenuActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppThemeFarmer"
            android:exported="false"/>
        <activity
            android:exported="false"

            android:name=".registration.EditUserActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppThemeFarmer" />
        <activity
            android:exported="false"

            android:name=".fisherman.FishermanIdActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppThemeFarmer" />
        <activity
            android:exported="false"

            android:name=".admin.AdminHomeActivity"
            android:screenOrientation="portrait" />

        <uses-library
            android:name="org.apache.http.legacy"
            android:required="false" />

        <activity
            android:exported="false"

            android:name=".farmer.FarmerPondListActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppThemeFarmer" />
        <activity
            android:exported="false"

            android:name=".farmer.FarmerHomeActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppThemeFarmer" />
        <activity
            android:exported="false"

            android:name=".registration.OtpPhoneNumberActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppThemeFarmer" />
        <activity
            android:exported="false"

            android:name=".registration.OtpPageActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppThemeFarmer" />
      
        <activity
            android:exported="false"

            android:name=".tutorial.YouTubeTutorialActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppTheme.NoActionBar" />
        <activity
            android:exported="false"

            android:name=".fisherman.FishermanMainActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppThemeFarmer" />
        <activity
            android:exported="false"

            android:name=".fisherman.FishermanFormActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppThemeFarmer" />
        <activity
            android:exported="false"

            android:name=".river.RiverMenuActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppThemeFarmer" />
        <activity
            android:exported="false"

            android:name=".river.RiverListActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppThemeFarmer" />

        <meta-data
            android:name="com.google.android.geo.API_KEY"
            android:value="@string/google_maps_key" />

       
        <activity
            android:exported="false"

            android:name=".admin.SmsActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppThemeFarmer" />
        <activity
            android:exported="false"

            android:name=".admin.FishPondMapActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppTheme.NoActionBar" />
        <activity
            android:exported="false"

            android:name=".admin.FarmerListActivity"
            android:screenOrientation="portrait" />
        <activity
            android:exported="false"

            android:name=".farmer.FarmerUploadDataActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppTheme.NoActionBar" />
        <activity
            android:exported="false"

            android:name=".farmer.GetLocationInMapActivity"
            android:screenOrientation="portrait" />
        <activity
            android:exported="false"

            android:name=".farmer.FarmerCenterActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppThemeFarmer" />
        <activity
            android:exported="false"

            android:name=".registration.LoginActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppTheme.NoActionBar" />
        <activity
            android:exported="false"

            android:name=".registration.RegistrationActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppTheme.NoActionBar"
            android:windowSoftInputMode="adjustResize" />
        <activity
            android:exported="true"

            android:name=".SplashScreen"
            android:theme="@style/SplashTheme">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
        <activity
            android:exported="false"

            android:name=".MainActivity"
            android:screenOrientation="portrait"
            android:theme="@style/AppThemeFarmer" />


<receiver android:name=".otpReader.SmsBroadcastReceiver"
    android:exported="false"
    android:permission="com.google.android.gms.auth.api.phone.permission.SEND">
        <intent-filter>
            <action android:name="com.google.android.gms.auth.api.phone.SMS_RETRIEVED"/>

        </intent-filter>
</receiver>

    </application>

</manifest>

使用的SmsBroadcastReceiver如下...

公共类 SmsBroadcastReceiver 扩展 BroadcastReceiver {

public SmsBroadcastReceiverListener smsBroadcastReceiverListener;

@Override
public void onReceive(Context context, Intent intent) {
    if (intent.getAction() == SmsRetriever.SMS_RETRIEVED_ACTION) {
        Bundle extras = intent.getExtras();
        Status smsRetrieverStatus = (Status) extras.get(SmsRetriever.EXTRA_STATUS);

        switch (smsRetrieverStatus.getStatusCode()) {
            case CommonStatusCodes.SUCCESS:
                Intent messageIntent = extras.getParcelable(SmsRetriever.EXTRA_CONSENT_INTENT);
                smsBroadcastReceiverListener.onSuccess(messageIntent);
                break;
            case CommonStatusCodes.TIMEOUT:
                smsBroadcastReceiverListener.onFailure();
                break;
        }
    }
}
public interface SmsBroadcastReceiverListener {
    void onSuccess(Intent intent);
    void onFailure();
}

}

短信是这样自动读取的...

      private void startSmsUserConsent() {
    SmsRetrieverClient client = SmsRetriever.getClient(this);

    client.startSmsUserConsent(null).addOnSuccessListener(new OnSuccessListener<Void>() {
        @Override
        public void onSuccess(Void aVoid) {
            Toast.makeText(getApplicationContext(), "Waiting for OTP", Toast.LENGTH_LONG).show();
        }
    }).addOnFailureListener(new OnFailureListener() {
        @Override
        public void onFailure(@NonNull Exception e) {
            Toast.makeText(getApplicationContext(), "OTP auto-read error", Toast.LENGTH_LONG).show();
        }
    });
}
private void registerBroadcastReceiver() {
    smsBroadcastReceiver = new SmsBroadcastReceiver();
    smsBroadcastReceiver.smsBroadcastReceiverListener =
            new SmsBroadcastReceiver.SmsBroadcastReceiverListener() {
                @Override
                public void onSuccess(Intent intent) {
                    startActivityForResult(intent, REQ_USER_CONSENT);

                    otpButtonPage.setEnabled(true);
                    otpButtonPage.setText("Next");

                }
                @Override
                public void onFailure() {
                }
            };
    IntentFilter intentFilter = new IntentFilter(SmsRetriever.SMS_RETRIEVED_ACTION);
    registerReceiver(smsBroadcastReceiver, intentFilter);
}
@Override
protected void onStart() {
    super.onStart();
    registerBroadcastReceiver();
}
@Override
protected void onStop() {
    super.onStop();
    unregisterReceiver(smsBroadcastReceiver);
}
@Override
protected void onActivityResult(int requestCode, int resultCode, @Nullable Intent data) {
    super.onActivityResult(requestCode, resultCode, data);
    if (requestCode == REQ_USER_CONSENT) {
        if ((resultCode == RESULT_OK) && (data != null)) {
            //That gives all message to us.
            // We need to get the code from inside with regex
            //IF ALLOW IS CLICK
            String message = data.getStringExtra(SmsRetriever.EXTRA_SMS_MESSAGE);


            // Toast.makeText(getApplicationContext(), "OTP sent successfully", Toast.LENGTH_LONG).show();
           /* textViewMessage.setText(
                    String.format("%s - %s", getString(R.string.received_message), message));
            */
            getOtpFromMessage(message);
        }
    }
}

【问题讨论】：

请显示 AndoidManifest。
这与依赖无关，我认为这与意图转换有关，如果您使用任何应用程序都可以接受和使用的隐式意图，或者如果您使用广播接收器，请检查此链接并阅读本节末尾的警告，看看它是否有帮助 - developer.android.com/guide/components/intents-filters#Types
@CoolMind 感谢您的回复，我已经发布了我的 Android 清单
@Thanpuia，谢谢。你在代码中有广播接收器吗？也可能依赖的 AndrodManifests 可能会导致这个错误。
@Thanpuia，我没有收到此错误，也不知道。但是你的代码是正确的。 startActivityForResult()拍照不能成为理由。您是否要求 SMS 的权限？也许AndroidManifest 中应该有一个BroadcastReceiver，比如stackoverflow.com/questions/45670263/…。你是怎么看短信的？

标签： android android-studio

【解决方案1】：

我终于明白了。一百万次感谢您的所有回答。它是广播接收器，在article 和answer 的帮助下，我能够进行一些更改，谷歌游戏终于接受了我的更新。以下是新代码：

 protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_otp_page);

    /* //TO COMPLY WITH GOOGLE PLAY POLICY*/
    HandlerThread handlerThread = new HandlerThread("MyNewThread");
    handlerThread.start();
    Looper looper = handlerThread.getLooper();
    handler = new Handler(looper);       
  ....
  }

 private void registerBroadcastReceiver() {
    smsBroadcastReceiver = new SmsBroadcastReceiver();
    smsBroadcastReceiver.smsBroadcastReceiverListener =
            new SmsBroadcastReceiver.SmsBroadcastReceiverListener() {
                @Override
                public void onSuccess(Intent intent) {
                    startActivityForResult(intent, REQ_USER_CONSENT);

                }
                @Override
                public void onFailure() {
                }
            };
    IntentFilter intentFilter = new IntentFilter(SmsRetriever.SMS_RETRIEVED_ACTION);

  /*TO COMPLY WITH GOOGLE PLAY POLICY*/
    registerReceiver(smsBroadcastReceiver,intentFilter, SmsRetriever.SEND_PERMISSION,handler);
}

【讨论】：