1839366 - Specify if broadcast receivers should be exported or not.

Status: VERIFIED FIXED

(Firefox for Android :: General, task, P1)

Description

[Mihai Adrian Carare [:mcarare]]

Apps and services that target Android 14 and use context-registered receivers are required to specify a flag to indicate whether or not the receiver should be exported to all other apps on the device: either RECEIVER_EXPORTED or RECEIVER_NOT_EXPORTED, respectively. This requirement helps protect apps from security vulnerabilities by leveraging the features for these receivers introduced in Android 13.

Source

The same documentation states that receivers that only receive system broadcasts are exempt from this, but the ContextCompat registerReceiver method documentation states that you can add RECEIVER_NOT_EXPORTED if you only want your receiver to be able to receive broadcasts from the system or your own app. So I am inclined to choose to specify this explicitly even for receivers of system broadcasts.

The list of System Broadcast Intents can be found here.

Comment 1

[BMO Github Automation]

Attachment: [mozilla-mobile/firefox-android] Bug 1839366 - Specify if broadcast receivers should be exported or not. (#2548)

Comment 2

[BMO Github Automation]

Authored by https://github.com/mcarare
https://github.com/mozilla-mobile/firefox-android/commit/1ea20c146103b547820c6204da7022f2d27a7a2c
[main] Bug 1839366 - Add is exported flag when registering receivers.

Comment 3

[Mihai Adrian Carare [:mcarare]]

For QA, please check that the download stated ( start/pause/ finished) is correctly reflected in the notification.

Comment 4

[Lorand Janos]

Verified as fixed on the latest Nightly build (117.0a1 from 2023-07-28).

Devices used:

• Google Pixel 7 (Android 14)
• Oppo Find X5 (Android 13)
• Samsung Galaxy Tab A7 (Android 13)
• Redmi 9C NFC (Android 10)

Marking the ticket as verified.