Kotlin URL Handling

This lesson demonstrates security issues that should be taken into account when using custom URL handlers as inter-process communication (IPC) method in an Android App.

Intro

Have the user set the test URL in MainActivity.kt and then run the App.

Validate URL

Our URL scheme expects an integer ID value.

Have the user change the URL to have an invalid id (specifically a string).
The user should then update the code to validate the URL is in the expected format.

In MainActivity.kt, change the code:

Router.showFriend(u.toInt())

to validate the id parameter is an integer:

try {
	Router.showFriend(u.toInt())
} catch(e: NumberFormatException){
	println("Number format exception")
}

Validate Action

Just because a URL is in a valid format doesn't mean it should trigger the requested action in the App. Have the user make sure a user is logged into our app before routing to the requested screen from the url

To fix this issue, check for a logged in user:

Add this code in MainActivity.kt, before:

if (route == "showfriend") {
    ...
}

after:

if (route == "showfriend") {
    if (UserManager.currentUser == null) {
        Router.showLogin()
        return
    }
    ...
}

Check logged in is still correctly handled

Mock a user login by uncomment line 17 in MainActivity.kt to "log in" a user and then verify the code correctly routes to the friend screen

Use a Whitelist

A URL can be sent to an app by any other Android app. In many cases it can make sense to restrict the apps that can command your app. Use a whitelist to check for the Google Maps App.

Change the following code in MainActivity.kt, before:

if (Intent.ACTION_VIEW == appLinkAction) {
    ...
}

after:

if (Intent.ACTION_VIEW == appLinkAction) {
    val host = getReferrer().getHost()
    if (host != "com.google.android.apps.maps") {
        Router.showForbidden()
        return            
    }     
    ...
}