Skip to content

Commit

Permalink
Add intent verification to BroadcastReceiver classes
Browse files Browse the repository at this point in the history
Update onReceive methods to check for correct action before proceeding. This prevents potential risk of third-party applications to send explicit intents to this receiver to cause a denial of service.

Update formatting to address linting errors
  • Loading branch information
jennantilla committed Nov 7, 2023
1 parent ae8991b commit 2320ee5
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 0 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,11 @@ class BootUpReceiver : BroadcastReceiver() {
context: Context,
intent: Intent,
) {
// Return early if the action does not match expected action
if (intent.action != Intent.ACTION_BOOT_COMPLETED)
{
return
}
if (!OneSignal.initWithContext(context)) {
return
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
*/
package com.onesignal.notifications.receivers

import android.app.Notification.Action
import android.content.BroadcastReceiver
import android.content.Context
import android.content.Intent
Expand All @@ -41,6 +42,11 @@ class UpgradeReceiver : BroadcastReceiver() {
// TODO: Now that we arent restoring like we use to, think we can remove this? Ill do some
// testing and look at the issue but maybe someone has a answer or rems what directly
// was causing this issue
// Return early if the action does not match expected action
if (intent.action != Intent.ACTION_MY_PACKAGE_REPLACED)
{
return
}
// Return early if using Android 7.0 due to upgrade restore crash (#263)
if (Build.VERSION.SDK_INT == Build.VERSION_CODES.N) {
return
Expand Down

0 comments on commit 2320ee5

Please sign in to comment.