airbnb / airbnb/DeepLinkDispatch
How to prevent unsafed intent key override
- Dominant language
- Kotlin
- Stars
- 4.4k
- Forks
- 414
- PR merge metrics
- No merged PRs in 30d
Description
If I don't check intent key `DeepLink.IS_DEEP_LINK`, how can I safe start a deep link url come from an external app?
```
public class TodoDetailActivity extend Activity {
private static final String KEY_ID = "id";
@Override
protected void onCreate(Bundle savedInstanceState) {
// I Can't get `17` from url `todoapp://todos/17`, because the value is a String
long id = getIntent().getLong(KEY_ID);
}
public static Intent actionSeeDetail(Context context, long id) {
Intent intent = new Intent(context, TodoDetailActivity.class);
intent.putExtra(KEY_ID, id); // value type: long
return intent;
}
@AppLink("todos/{id}")
public static Intent intentForLink(Context context, Bundle extras) {
return actionSeeDetail(context, safeParseLong(extras.getString("id")));
}
}
```
How can I prevent `DeepLinkDelegate` override the key `id` to a `String` value?
Contributor guide
Research direction
Start by tracing DeepLinkDelegate handling for the @AppLink("todos/{id}") entry point and compare it with TodoDetailActivity.actionSeeDetail. Reproduce the external todoapp://todos/17 path and the internal Intent, then verify that the id extra retains the intended type without unsafe overriding.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, java
- Domain
- mobile
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100