Android App Security · Components & Intents · Lesson 5 of 5

Challenge: The StudyBuddy Review

Review a friend's app before launch and find the doors she left open.

The case brief

Your cousin Maya built StudyBuddy, an app for sharing class notes. Before she publishes it, she asks you to look over her manifest. Here's what it declares:

• .MainActivity, exported="true", with the MAIN/LAUNCHER filter.
• .ImportActivity, exported="true", with a filter for ACTION_SEND and application/pdf, so other apps can share PDFs into StudyBuddy.
• .AdminActivity, exported="true", no intent filter. It deletes any note and skips the sign-in check. Maya says: "Only my own app ever opens it, and nobody knows the name."
• .NotesProvider, exported="false", grantUriPermissions="true".
• .SyncService, exported="false".

She also sends sign-in emails with links like studybuddy://login?token=8f3k..., and she shares notes with other apps by passing a file:// path. She plans to launch next week and wants a clear list of what to change first.

The sign-in link

Maya's friend tests the beta. He has a second app installed, a homework tracker from an unknown developer, which also declares an intent filter for the studybuddy:// scheme. When he taps his sign-in email, the phone offers both apps, and the tracker could receive the link with his sign-in token in it.

Maya is surprised that another app is even allowed to claim her scheme.

The broken share

Next, Maya shows you a bug. When a user shares a note to Messages, StudyBuddy sends an intent with a file:// path to a file in its private storage. On her test phone running Android 15, the share fails with an error before Messages even opens.

She wants to fix it without letting other apps browse all of her users' notes.

The better link

Maya decides to drop the custom scheme. Sign-in emails will now use https://studybuddy.example/login, and the link will carry a short-lived code instead of a long-lived token. She adds an intent filter for that address.

She wants the link to open StudyBuddy directly on Android 12 and later, and she wants a copycat app with a different signing key to be unable to take it over.