Android: are context-registered broadcast receivers exported?

user_337455 0
Viewed 4306

If I register a broadcast receiver say in my activity like this,

@Override
protected void onResume() {
    super.onResume();

    myReceiver = new BroadcastReceiver() { ... };
    IntentFilter filter = new IntentFilter("com.example.MY_ACTION");
    registerReceiver(myReceiver, filter);
}

Is this receiver exported? if another app broadcasts com.example.MY_ACTION, will it be received by myReceiver?

If it is, I assume I need to use the form of registerReceiver() that accepts a string permission, and then define that permission in my manifest, giving it a high protection level (such as signature). Is that correct? Is there a simpler way?

android-broadcast broadcastreceiver android
3 Answers

To spare others the work and for my own archiving purposes: Yes, context-registered receivers are exported by default.

There doesn't seem to be a lot of documentation but you can validate this quickly by running a separate app sending a custom broadcast. I tested this on APIs 16-29, the broadcast will be received and so every package will be able to send to your receiver (which can be a security flaw).

To solve the issue without using local broadcasts (should be used wherever possible) you are on the right track in defining a custom permission and restricting broadcasts to apps that have requested that permission. For the sake of completeness:

Define and use a custom permission in the manifest:

<permission android:name="com.example.bcrtest.BROADCAST_PERMISSION"
    android:protectionLevel="signature"/>
<uses-permission android:name="com.example.bcrtest.BROADCAST_PERMISSION" />

Register receiver with permission:

registerReceiver(mReceiver, new IntentFilter(MY_INTENT_ACTION), "com.example.bcrtest.BROADCAST_PERMISSION", null );
user_21165600

As others have pointed out, use a LocalBroadcastManager like this:

lateinit var localBroadcastManager: LocalBroadcastManager

localBroadcastManager = LocalBroadcastManager.getInstance(this)

localBroadcastManager.registerReceiver(
            myReceiver,
            filter
        )
user_69986840
Related