...
This noncompliant code example shows an AndroidManifest.xml file for an application that acts on receiving an intent without checking the caller's identityexports the activity to other apps, but does not restrict access to its sensitive activity:
| Code Block | ||||||
|---|---|---|---|---|---|---|
| ||||||
<activity android:configChanges="keyboard|keyboardHidden|orientation" android:name=".media.yfrog.YfrogUploadDialog" android:theme="@style/Vulnerable.Dialog" android:windowSoftInputMode="stateAlwaysHidden"> <intent-filter android:icon="@drawable/yfrog_icon" android:label="@string/YFROG"> <action android:name="jp.co.vulnerable.ACTION_UPLOAD" /> <category android:name="android.intent.category.DEFAULT" /> <data android:mimeType="image/*" /> <data android:mimeType="video/*" /> </intent-filter> </activity> |
...