Blankj / Blankj/AndroidUtilCode

NetworkUtils安全检测到动态注册广播风险

Open
#1,794 2 comments 0 reactions 1 assignee Claimed by @Blankj View on GitHub
bug
Dominant language
Java
Stars
33.6k
Forks
10.6k
PR merge metrics
No merged PRs in 30d

Description

## 描述 Bug

简洁地描述下 Bug。

- AndroidUtilCode 的版本:com.blankj:utilcodex:1.31.1
NetworkUtils安全检测到动态注册广播风险,如果在动态注册时采用的全局方式进行注册,则这个receiver在生命周期中默认是可导出的,如果没有设置访问权限,系统应用或者第三方应用可以操作此receiver,导致敏感信息泄露,可能受到权限绕过、拒绝服务等攻击。

## 相关代码

`
文件:
com.blankj.utilcode.util.NetworkUtils$NetworkChangedReceiver$1.java
方法:
public void run()
代码:
v1.registerReceiver(v2, v0);
`

## 建议修复
1.使用 LocalBroadcastManager 来替代registerReceiver注册,保证数据传递仅限于应用内。
2.使用registerReceiver(BroadcastReceiver, IntentFilter,
broadcastPermission,android.os.Handle)替代registerReceiver(BroadcastReceiver, IntentFilter),检验权限。
3.在 AndroidManifest.xml 文件中静态注册BroadcastReceiver,同时设置 exported="false"。

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.