apache / apache/cordova-android

Google Play Console: App rejected due to Intent Redirection vulnerability

Open
#1,504 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
1.6k
Avg merge
16h 18m
Merged PRs (30d)
11

Description

# Bug Report

## Problem
Google Play Console: App rejected due to Intent Redirection vulnerability,
org.apache.cordova.CordovaInterfaceImpl.startActivityForResu

### What is expected to happen?
App should approve and publish without any issues

### What does actually happen?
App rejects during the google play console review process

## Information
Cordova Android application gets rejected during the play store review process. And their response is this,

We rejected xx with package name xx, for violating our Device and Network Abuse or User Data policy. This app uses software that contains security vulnerabilities for users or allows the collection of user data without proper disclosure.

The issue comes from this: org.apache.cordova.CordovaInterfaceImpl.startActivityForResult

![image](https://user-images.githubusercontent.com/33131182/194303536-41514ac5-c9f9-4776-9877-ac72d932a3f7.png)

The app .apk file works on Android devices without any issues.

### Command or Code

AndroidManifest.xml
```












```

### Environment, Platform, Device
Android
Google Play Console App Review

## Checklist

- [x] I searched for existing GitHub issues
- [ ] I updated all Cordova tooling to most recent version
- [x] I included all the necessary information above

Contributor guide

Open the contributing guide

Research direction

The report identifies AndroidManifest.xml and org.apache.cordova.CordovaInterfaceImpl.startActivityForResult as the affected entry point. Start by tracing that method in the cordova-android source and compare the reported Intent Redirection finding with the Google Play rejection details; done means the reported vulnerability is addressed and the app passes review.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java, javascript
Domain
mobile-dev, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.