We were asked to make changes to our react native app when an updated version was submitted to Google Play Store. The issue highlighted was "Intent Redirection" vulnerability. It was legacy code, but nevertheless, better late than never.
One of the suggested methods in the Google help guide was this:
Option 2: Ensure that the extracted Intent is from a trustworthy source.
You can verify that the originating Activity can be trusted using methods like >getCallingActivity. For example:
// check if the originating Activity is from trusted package
if (getCallingActivity().getPackageName().equals(“known”)) {
Intent intent = getIntent();
// extract the nested Intent
Intent forward = (Intent) intent.getParcelableExtra(“key”);
// redirect the nested Intent
startActivity(forward);
}
On changing code as per this guidance, the build showed an error that getCallingActivity was not a known symbol. The code already uses getCurrentActivity and getApplicationContext.
What would be the best way for us to rectify in our React Native app, this vulnerability in our native Java code?
Will deeply appreciate your quick support here. Thanks!
