I try to use the code from the Android materials to fetch information about sharing. I follow the training materials: https://developer.android.com/training/sharing/send#share-interaction-data
This part of code (copy&paste from the developer.android.com):
Intent share = new Intent(ACTION_SEND);
...
PendingIntent pi = PendingIntent.getBroadcast(myContext, requestCode,
new Intent(myContext, MyBroadcastReceiver.class),
PendingIntent.FLAG_UPDATE_CURRENT);
share = Intent.createChooser(share, null, pi.getIntentSender());
does throw an exception:
Targeting S+ (version 31 and above) requires that one of FLAG_IMMUTABLE or FLAG_MUTABLE be specified when creating a PendingIntent. Strongly consider using FLAG_IMMUTABLE, only use FLAG_MUTABLE if some functionality depends on the PendingIntent being mutable, e.g. if it needs to be used with inline replies or bubbles.
When I add this flag (PendingIntent.FLAG_IMMUTABLE) then I can’t fetch information about sharing:
@Override public void onReceive(Context context, Intent intent) {
...
ComponentName clickedComponent = intent.getParcelableExtra(EXTRA_CHOSEN_COMPONENT);
}
getParcelableExtra(EXTRA_CHOSEN_COMPONENT) returns null.
If I use the flag PendingIntent.FLAG_MUTABLE, everything works. BUT (!) it seems that this is not recommended by Google (as it might be a security issue):
Google recommends that developers fix the vulnerability by applying any (or even better, all) of the following:
- Ensuring that the action, package, and component fields of the base Intent are set;
- Ensuring that the PendingIntent is only delivered to trusted components;
- Using FLAG_IMMUTABLE (added in SDK 23) to create PendingIntents. This prevents apps that receive the PendingIntent from filling in unpopulated properties. (…)
(https://support.google.com/faqs/answer/10437428?hl=en)
How can I implement the solution that retrieves information about the clicked component in a safe way?