Insecure Random Number Generator in ActivityResultRegistry [272096025]

Fixed

Bug

Status Update

No update yet.

Description

we...@salesforce.com

created issue #1

Mar 8, 2023 03:30PM

Hello, in a security audit we found an instance of insecure Random Number Generator.

File androidx/activity/result/ActivityResultRegistry.java near line 25:

This is the report we got:
Category Cryptography and Insecure Storage
Testing Method Black Box
Tools Used Apktool, dex2jar, jd-gui

Component used: Activity

Version used: 1.8

Devices/Android versions reproduced on: Android api 31.

If this is a bug in the library, we would appreciate if you could attach:
- Sample project to trigger the issue.
- A screenrecord or screenshots showing the issue (if UI related).

Wed Mar 08 2023 12:29:47 GMT-0300 (Argentina Standard Time).png

35 KB

View

Download

Comments

jb...@google.com <jb...@google.com> Mar 9, 2023 12:01AM

Assigned to jb...@google.com.

ap...@google.com <ap...@google.com> #2Mar 9, 2023 01:52AM

Using navigation version 2.6.0 and 2.7.1 the issue still persists.

After further investigation, the behaviour can be corrected by filtering on backstack entries where current state is at least started. In my opinion the name visibleEntries is misleading if it contains entries that are not actually visible or in transition.

il...@google.com <il...@google.com> #3Mar 9, 2023 05:44PM

Marked as fixed.

Note that as per the visibleEntries documentation, it is expected that there are entries that are in the CREATED state - those are the entries that are in the process of being removed (i.e., they are no longer in the back stack, but have not yet marked their transition as complete).

It is a bug that those entries aren't removed when their exit animation completes and that's what we'll be looking into.

we...@salesforce.com <we...@salesforce.com> #4Mar 10, 2023 11:45AM

Project: platform/frameworks/support
Branch: androidx-main

commit f61da31809827bfac89af629c88ad9b8423e88b6
Author: Clara Fok <clarafok@google.com>
Date: Wed Sep 06 14:14:11 2023

Fix entry not marked complete after view is destroyed

As part of a fix for

b/279644470

in aosp/2566210, when the fragment view is destroyed, we would mark the transitioning (outgoing) entry as complete only if the entry has also been removed from backstack. However, in the simple navigate() case where the outgoing entry is not popped and remains in the backstack, this entry is not marked complete and ends up in the visibleEntries even though the view has been destroyed.

Now the backstack check in ON_DESTROY is no longer necessary to fix the original

b/279644470

bug -- the view being destroyed should be the right signal for completing entries regardless of whether transitioning effects are used. So this check is removed.

Test: ./gradlew navigation:navigation-fragment:cC
Test: ./gradlew navigation:navigation-runtime:cC
Bug: 288520638
Change-Id: I5caa9af1b5bd7084e76d7daf9515f7430bf2489d

M navigation/navigation-fragment/src/androidTest/java/androidx/navigation/fragment/FragmentNavigatorTest.kt
M navigation/navigation-fragment/src/androidTest/java/androidx/navigation/fragment/NavControllerWithFragmentTest.kt
M navigation/navigation-fragment/src/main/java/androidx/navigation/fragment/FragmentNavigator.kt
M navigation/navigation-runtime/src/androidTest/java/androidx/navigation/NavControllerTest.kt
M navigation/navigation-runtime/src/main/java/androidx/navigation/NavController.kt

https://android-review.googlesource.com/2743918

Issue 272096025

Description

Issue summary

Comments

jb...@google.com <jb...@google.com> Mar 9, 2023 12:01AM

ap...@google.com <ap...@google.com> #2Mar 9, 2023 01:52AM

il...@google.com <il...@google.com> #3Mar 9, 2023 05:44PM

we...@salesforce.com <we...@salesforce.com> #4Mar 10, 2023 11:45AM

Add comment

Issue metadata