Android Legacy Security

Standards for Intents, WebViews, and FileProvider

fierzone Updated

File contents

Android Legacy Security Standards

Priority: P0

Implementation Guidelines

Intents

  • Implicit: Always verify resolveActivity before starting.
  • Exported: Verify android:exported logic (as per security skill).
  • Data: Treat all incoming Intent extras as untrusted input.

WebView

  • JS: Default to javaScriptEnabled = false. Only enable for trusted domains.
  • File Access: Disable allowFileAccess to prevent local file theft via XSS.

File Exposure

  • FileProvider: NEVER expose file:// URIs. Use FileProvider.

Anti-Patterns

  • Implicit Internal: **No Implicit for Internal**: Use Explicit Intents (class name).
  • World Readable: **No MODE_WORLD_READABLE**: SharedPreferences/Files.

References

  • Hardening Examples

fierzone/agent-skills-standard/tree/main/skills/android/legacy-security commit d83562cf55

Frequently asked questions

npx skillmds@latest add fierzone/android-legacy-security