element-hq / element-hq/element-android
Incorrectly configured intent filters
- Dominant language
- Kotlin
- Stars
- 3.7k
- Forks
- 917
- PR merge metrics
- No merged PRs in 30d
Description
### Steps to reproduce
visit incorrectly configured intents such as on android web browser or other app, while element is installed.
https://user/whatever
http://room/whatever
The
### Outcome
Element is offered as an option to open these links. This shouldn't be the case, and while unlikely, end users may have some intranet site or other use case for visiting https://user/
According to the documentation here, intent filters apply to all combinations of schema and host defined in the xml.
> it's important that you create separate filters when your intention is to declare unique URLs (such as a specific combination of scheme and host), because multiple elements in the same intent filter are actually merged together to account for all variations of their combined attributes.
https://developer.android.com/training/app-links/deep-linking#adding-filters
So in this case the intent filters are applied to all combinations, including the following undesired ones
https://github.com/vector-im/element-android/blob/develop/vector/src/main/AndroidManifest.xml#L228
* http(s)://user/
* http(s)://room/
* element://matrix.to/
### Your phone model
_No response_
### Operating system version
_No response_
### Application version and app store
_No response_
### Homeserver
_No response_
### Will you send logs?
No
Contributor guide
Assessment
This issue has not been assessed yet.