Search code examples
javaandroidsecurityandroid-intentandroid-pendingintent

Qark reports a PendingIntent security issue on java files: zzaup, zzst, zze, MediaButtonReceiver, TaskStackBuilder

I'm working on an already existing app and I had to test the code security vulnerabilities using QARK (Quick Android Review Kit).

When I run this tool it reports this problems related to Pending Intents:
In these Java classes:
  - myApp/classes_dex2jar/com/google/android/gms/internal/zzaup.java
  - myApp/classes_dex2jar/com/google/android/gms/internal/zzst.java
  - myApp/classes_dex2jar/com/google/android/gms/common/zze.java
  - myApp/classes_dex2jar/android/support/v4/media/session/MediaButtonReceiver.java
  - myApp/classes_dex2jar/android/support/v4/app/TaskStackBuilder.java

With the same warning:

Implicit Intent: localIntent used to create instance of PendingIntent. A malicious application could potentially intercept, redirect and/or modify (in a limited manner) this Intent. Pending Intents retain the UID of your application and all related permissions, allowing another application to act as yours.
File: myApp/classes_dex2jar/[folder structure for each java class listed above].java
More details: https://www.securecoding.cert.org/confluence/display/android/DRD21-J.+Always+pass+explicit+intents+to+a+PendingIntent

Error example


I really have no idea what to do. In my code there isn't any of these classes, neither PendingIntent.   (Only 1 implicit intent to open a simple link in browser, nothing else!)

Any suggestion???

Solution

  • I answer myself so that I can help those who need it in the future.

    Simply, the report that was given to me was generated with an old version of QARK (beginning of July 2018, version 1.2, the current one is 4.0.)

    Searching on the internet I found this issue (now closed) in which it is said that:

    "The blog posts are old and use the release version of QARK. In the newer version (with more checks, faster execution, and less false positives) we have a simple report for now. [...]".


    Good luck to all and good development! 🤞