[Android] Migrate remaining internal `Intent.get*Extra` calls to `IntentUtils`
- Dominant language
- Dart
- Stars
- 179k
- Forks
- 31.1k
- PR merge metrics
- PR metrics pending
Description
To prevent malicious apps from injecting unexpected `Intent` extras during startup, https://github.com/flutter/flutter/pull/190249 introduces a custom lint rule banning direct `Intent.get*Extra` calls in favor of safe wrappers (`IntentUtils.safeGet...Extra`). This issue tracks migrating the remaining exempted files (`FlutterActivity`, `FlutterFragmentActivity`, `FlutterShellArgs`, and `FlutterEngineConnectionRegistry`) to use these safe wrappers, which will verify that `Intent` extra flags are sent from the Flutter app itself in debug/profile mode or otherwise block them (including in release mode).
Files I am sure can be fully migrated:
- [ ] `FlutterActivity.java`
- [ ] `FlutterFragmentActivity.java`
- [ ] `FlutterEngineConnectionRegistry.java`
Contributor guide
Assessment
This issue has not been assessed yet.