github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-05-09 05:20:24 -05:00
Code Issues 1.1k Packages Projects Releases 122 Wiki Activity

[PR #1691] [MERGED] Fix Unsafe deserialization of Parcel data Intent #40147

New Issue
Closed
opened 2026-04-23 19:01:58 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-23 19:01:58 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/bitwarden/android/pull/1691
Author: @fedemkr
Created: 12/15/2021
Status: ✅ Merged
Merged: 12/15/2021
Merged by: @fedemkr

Base: master ← Head: bug/parcelable_attack_crash

📝 Commits (2)

  • cef1e88 Fix crash produced by unsafe deserialization of Parcel data passed on the intent
  • fe47fd1 Fix crash produced by unsafe deserialization of Parcel data passed on the intent on other activities and renamed intent extension method

📊 Changes

5 files changed (+39 additions, -1 deletions)

View changed files

📝 src/Android/Accessibility/AccessibilityActivity.cs (+2 -0)
📝 src/Android/Android.csproj (+1 -0)
📝 src/Android/MainActivity.cs (+4 -0)
➕ src/Android/Utilities/IntentExtensions.cs (+22 -0)
📝 src/Android/WebAuthCallbackActivity.cs (+10 -1)

📄 Description

Type of change

  • Bug fix
  • New feature development
  • Tech debt (refactoring, code cleanup, dependency upgrades, etc)
  • Build/deploy pipeline (DevOps)
  • Other

Objective

Fix crash produced by unsafe deserialization of parcel data intent attack.

The problem lies in that when creating the activity this is called and if there are any extras then a bundle is requested in FcmLifecycleCallbacks that will cause to call the Bundle.getBundle(...) which calls unparcel() and if the attacker planted a parcelable class that can't be found in the app then it will make the app crash.

Code changes

  • MainActivity.cs: Call ValidateIntent to check whether the extras can be unparcelled.

Testing requirements

Before you submit

  • I have added unit tests where it makes sense to do so (encouraged but not required)
  • This change requires a documentation update (notify the documentation team)
  • This change has particular deployment requirements (notify the DevOps team)

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/bitwarden/android/pull/1691 **Author:** [@fedemkr](https://github.com/fedemkr) **Created:** 12/15/2021 **Status:** ✅ Merged **Merged:** 12/15/2021 **Merged by:** [@fedemkr](https://github.com/fedemkr) **Base:** `master` ← **Head:** `bug/parcelable_attack_crash` --- ### 📝 Commits (2) - [`cef1e88`](https://github.com/bitwarden/android/commit/cef1e88f9c70bfd092815560dad70dfa2bc781f2) Fix crash produced by unsafe deserialization of Parcel data passed on the intent - [`fe47fd1`](https://github.com/bitwarden/android/commit/fe47fd1aff6370407f7c09b9964fc3cd663874c1) Fix crash produced by unsafe deserialization of Parcel data passed on the intent on other activities and renamed intent extension method ### 📊 Changes **5 files changed** (+39 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/Android/Accessibility/AccessibilityActivity.cs` (+2 -0) 📝 `src/Android/Android.csproj` (+1 -0) 📝 `src/Android/MainActivity.cs` (+4 -0) ➕ `src/Android/Utilities/IntentExtensions.cs` (+22 -0) 📝 `src/Android/WebAuthCallbackActivity.cs` (+10 -1) </details> ### 📄 Description ## Type of change - [X] Bug fix - [ ] New feature development - [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc) - [ ] Build/deploy pipeline (DevOps) - [ ] Other ## Objective <!--Describe what the purpose of this PR is. For example: what bug you're fixing or what new feature you're adding--> Fix crash produced by unsafe deserialization of parcel data intent attack. The problem lies in that when creating the activity this is called and if there are any extras then a bundle is requested in [FcmLifecycleCallbacks](https://github.com/firebase/firebase-android-sdk/blob/21a9f912862bfbd801690a9f88dce22366bec8ac/firebase-messaging/src/main/java/com/google/firebase/messaging/FcmLifecycleCallbacks.java#L40) that will cause to call the [Bundle.getBundle(...)](https://cs.android.com/android/platform/superproject/+/nougat-cts-release:frameworks/base/core/java/android/os/Bundle.java;l=817) which calls `unparcel()` and if the attacker planted a parcelable class that can't be found in the app then it will make the app crash. ## Code changes <!--Explain the changes you've made to each file or major component. This should help the reviewer understand your changes--> <!--Also refer to any related changes or PRs in other repositories--> * **MainActivity.cs:** Call ValidateIntent to check whether the extras can be unparcelled. ## Testing requirements <!--What functionality requires testing by QA? This includes testing new behavior and regression testing--> ## Before you submit - [ ] I have added **unit tests** where it makes sense to do so (encouraged but not required) - [ ] This change requires a **documentation update** (notify the documentation team) - [ ] This change has particular **deployment requirements** (notify the DevOps team) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-23 19:01:58 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#40147
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?