使得NFC私人活动没有机器人：出口= FALSE [英] making NFC Activity private without android:exported=false

问题描述

我有一个NFC活动，指定一个意图过滤器和数据。这有点像

I have an NFC activity which specifies an intent filter and data. This is something like

        <intent-filter>
            <action android:name="android.nfc.action..." />
            <category android:name="android.intent.category.DEFAULT" />

            <data
                android:host="..."
                android:path="..." />
        </intent-filter>

现在这里值得关注的是，由于我没有列入机器人：出口=假。它使这项活动容易受到来自外部的应用程序恶意攻击的活动，现在公开。这里的问题是，如果我把导出的属性为假，我不能够得到来自外部的意图称为活动（这是应该通过onNewIntent触发活动（））

Now the concern here is that since I have not included android:exported="false". it makes this activity susceptible to malicious attack from outside apps as the activity is now publicly available. The problem here is that if I put the exported attribute as false, I am not able to get the activity called from the outside intent (which is supposed to trigger the activity via onNewIntent() )

有没有一种方法，使活动安全的，而不是通过影响之外意图的一般的触发机制，即？

Is there a way to make the activity "safe" while not affecting its general triggering mechanism i.e. via outside intent?

推荐答案

如果你需要得到通知有关的标签，你需要的意图过滤器。标签调度员使用它来寻找感兴趣的活动时，标签被扫描来考虑。如果你让你的私人活动，就没有办法通知它，正如你所看到的。什么是恶意攻击'你关心？你的活动是安全的，因为你code它是：如果你只处理NFC的意图，你将是安全的（当然，除非对NFC负载触发设备，擦拭code或东西...）

If you need to get notified about tags, you need the intent filter. The tag dispatcher uses this to find interested activities to consider when a tag is scanned. If you make your activity private, there will be no way of notifying it, as you have seen. What 'malicious attacks' are you concerned about? Your activity is as safe as you code it to be: if you only handle NFC intents, you will be 'safe' (unless of course the NFC payload triggers a device-wiping code or something...)

这篇关于使得NFC私人活动没有机器人：出口= FALSE的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！