airbnb / airbnb/DeepLinkDispatch

How to prevent unsafed intent key override

Open
#227 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Kotlin
Stars
4.4k
Forks
414
PR merge metrics
No merged PRs in 30d

Description

If I don't check intent key `DeepLink.IS_DEEP_LINK`, how can I safe start a deep link url come from an external app?

```
public class TodoDetailActivity extend Activity {
private static final String KEY_ID = "id";

@Override
protected void onCreate(Bundle savedInstanceState) {
// I Can't get `17` from url `todoapp://todos/17`, because the value is a String
long id = getIntent().getLong(KEY_ID);
}

public static Intent actionSeeDetail(Context context, long id) {
Intent intent = new Intent(context, TodoDetailActivity.class);
intent.putExtra(KEY_ID, id); // value type: long
return intent;
}

@AppLink("todos/{id}")
public static Intent intentForLink(Context context, Bundle extras) {
return actionSeeDetail(context, safeParseLong(extras.getString("id")));
}
}
```

How can I prevent `DeepLinkDelegate` override the key `id` to a `String` value?

Contributor guide

Open the contributing guide

Research direction

Start by tracing DeepLinkDelegate handling for the @AppLink("todos/{id}") entry point and compare it with TodoDetailActivity.actionSeeDetail. Reproduce the external todoapp://todos/17 path and the internal Intent, then verify that the id extra retains the intended type without unsafe overriding.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java
Domain
mobile
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.