We received a notification for app rejection due to Intent redirection and to accommodate those we applied some checks in our code but still app was rejected today. Can you please read below which details on App requirement as well changes done to accommodate errors/warnings.
Brief about App: Our app uses combination of TWA (PWA Wrapper) and Native Android code, where authentication stuff majorly happens in native code and then on successful login user will be redirected to PWA using TWA Launcher activity. And in order to return back to native code from TWA we are making use of Intent filters. We went through options provided in the email under "Intent Redirection" (here), but none of 3 three exactly fits in our case i.e. from TWA Launcher web URL to Native android activity within same application. Although we added few extra checks, as shown in snippet below from webpage to Native code (Which is call by Depplink:
if (intent.`package` == null || !intent.`package`.equals(packageName)) {
finish()
}else {
//Business logic
// Open new activity from here
}
Below details fetch from Google play console portal.
Pre-launch report details
Intent Redirection
Errorbrightness_1Security
Your app contains an intent redirection vulnerability. Please see this Google Help Centre article for details.
• androidx.activity.ComponentActivity.startActivityForResult
Also at one place we were using startActivityForResult which is deprecated now and we replace it with new API (i.e. registerForActivityResult). Please refer code snippet below :
// Code snippet
Old Code:
val intent = Intent(this, TwaImplicationActivity::class.java)
startActivityForResult(intent, AppConstants.RequestCode.TWA_IMPLICATION)
New Changes:
twaActivityStartForResult = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result: ActivityResult ->
if(result.resultCode == Activity.RESULT_OK){
if(viewModel.showEnrolment.get()!!){
navigateToEnrolment()
} else {
navigateToLogin()
}
}
}
val intent = Intent(this, TwaImplicationActivity::class.java)
twaActivityStartForResult?.launch(intent)
If anything, I missed. Please let us know correct place, where I missed security check in our app?