Implicitly exported Android component¶
ID: java/android/implicitly-exported-component
Kind: problem
Security severity: 8.2
Severity: warning
Precision: high
Tags:
- security
- external/cwe/cwe-926
Query suites:
- java-code-scanning.qls
- java-security-extended.qls
- java-security-and-quality.qls
Click to see the query in the CodeQL repository
The Android manifest file defines configuration settings for Android applications. In this file, components can be declared with intent filters which specify what the components can do and what types of intents the components can respond to. If the android:exported attribute is omitted from the component when an intent filter is included, then the component will be implicitly exported.
An implicitly exported component could allow for improper access to the component and its data.
Recommendation¶
Explicitly set the android:exported attribute for every component or use permissions to limit access to the component.
Example¶
In the example below, the android:exported attribute is omitted when an intent filter is used.