Implicit Internal Intent vulnerability showing up when Android app is deployed to the Playstore

Question

Recently I have uploaded my android apk on the app store and its been told that the next upload to Google play store will get rejected and we need to check and resolve it. Below is the screenshot of the message:

They are referring to package name also. Below is the code:

 @Override
    public void onDestroy() {
        cleanup();
        super.onDestroy();
        Intent intent = new Intent("com.test.dummyapp");
        sendBroadcast(intent);
    }

Please assist me how to resolve this.

Below is the code where the component is triggered:

 IntentFilter restartFilter = new IntentFilter("com.test.dummyapp");
        registerReceiver(restartBroadcastReciver, restartFilter);



private BroadcastReceiver restartBroadcastReciver = new BroadcastReceiver() {
        @Override
        public void onReceive(Context context, Intent intent) {
          doBindService();
        }
    };

Answer 1

When you do this, you are broadcasting an "implicit Intent". This is dangerous because any app can register to get this (potential leak of information) and any app can also broadcast this Intent (triggering your app).

Intent intent = new Intent("com.test.dummyapp");
sendBroadcast(intent);

To fix this you can use LocalBroadcastManager (it is deprecated, but still works). Using a local broadcast ensures that other apps cannot see your broadcast Intent and other apps cannot trigger your app this way.

See https://developer.android.com/reference/androidx/localbroadcastmanager/content/LocalBroadcastManager

---

As an alternative, you should be able to make the Intent explicit by setting the package name:

Intent intent = new Intent("com.test.dummyapp");
intent.setPackage("my.package.name");
sendBroadcast(intent);