Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(share_plus): Set exported=false for BroadcastReceiver on Android #1613

Merged
merged 1 commit into from
Mar 17, 2023

Conversation

vbuberen
Copy link
Collaborator

Description

Addressing an issue reported in #1608. After looking at the documentation and code saw that we indeed don't need to have receiver exposed as only catch the intent that we launch from the app that uses share_plus

Docs on topic:

Tested the change - no issues with getting result of share in example app.

Related Issues

Closes #1608

Checklist

  • I read the Contributor Guide and followed the process outlined there for submitting PRs.
  • I titled the PR using Conventional Commits.
  • I did not modify the CHANGELOG.md nor the pubspec.yaml files.
  • All existing and new tests are passing.
  • The analyzer (flutter analyze) does not report any problems on my PR.

Breaking Change

Does your PR require plugin users to manually update their apps to accommodate your change?

  • Yes, this is a breaking change (please indicate that with a ! in the title as explained in Conventional Commits).
  • No, this is not a breaking change.

@vbuberen vbuberen added the share_plus Feature, Enhancement, Bug Fixes for Share Plus Plugin label Mar 11, 2023
@@ -14,7 +14,7 @@
</provider>
<!-- This manifest declared broadcast receiver allows us to use an explicit
Intent when creating a PendingItent to be informed of the user's choice -->
<receiver android:name=".SharePlusPendingIntent" android:exported="true">
<receiver android:name=".SharePlusPendingIntent" android:exported="false">
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we know why it was exported ? Was it on purpose or just a miss / was created exported by default?

Copy link
Collaborator Author

@vbuberen vbuberen Mar 14, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it that big deal? You can ping author, who initially added this receiver and ask. I guess, it it because the author isn't a mobile dev, but I don't see why we should care about it, considering that the issue is resolved.

Copy link
Member

@nohli nohli left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe it was added during the Android v2 migration.
Also, it's true by default.

Are we sure users won't run into issues like this?

@vbuberen
Copy link
Collaborator Author

Maybe it was added during the Android v2 migration.
Also, it's true by default.

It was added while adding share result functionality. As to default or not - I have attached the docs in the PR description about why it is Ok to set to false.

Are we sure users won't run into issues like this?

Yes, I am sure. The issue you linked is about not having exported property defined at all for one of components, not about true or false.

@vbuberen vbuberen merged commit 19b136d into main Mar 17, 2023
@vbuberen vbuberen deleted the fix/share_plus_receiver branch March 17, 2023 10:50
@charafau
Copy link
Contributor

thanks @vbuberen for PR !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
share_plus Feature, Enhancement, Bug Fixes for Share Plus Plugin
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Vulnerability]: Security scanner find vulnerability in broadcast receiver for share plus plugin
3 participants