Deep links regular expressions collision [184072811]

Fixed

Bug

androidx-bug-bounty

Status Update

No update yet.

Description

[Deleted User]

created issue #1

Mar 31, 2021 12:57PM

Artifact used: androidx.navigation:navigation-fragment-ktx:2.3.4
Version used: 2.3.4
Theme used: N/A
Devices/Android versions reproduced on: Any

Problem

We have the following navigation graph:

<?xml version="1.0" encoding="utf-8"?>
<navigation xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:app="http://schemas.android.com/apk/res-auto"
    xmlns:tools="http://schemas.android.com/tools"
    android:id="@+id/profile_graph"
    app:startDestination="@id/profileFragment">

    <fragment
        android:id="@+id/profileFragment"
        android:name="com.myapp.profile.ProfileFragment"
        tools:layout="@layout/fragment_profile">

        <argument
            android:name="userId"
            app:argType="string" />

        <action
            android:id="@+id/toProfileDetails"
            app:destination="@id/profileDetailsFragment" />

        <deepLink
            android:id="@+id/deepLinkProfile"
            app:uri="myapp://profiles/{userId}/" />

    </fragment>

    <fragment
        android:id="@+id/profileDetailsFragment"
        android:name="com.myapp.profile.ProfileDetailsFragment"
        tools:layout="@layout/fragment_profile_details">

        <argument
            android:name="userId"
            app:argType="string" />

        <deepLink
            android:id="@+id/deepLinkProfileDetails"
            app:uri="myapp://profiles/{userId}/details/" />

    </fragment>
</navigation>

Here are declared two deep links patterns:

myapp://profiles/{userId}/
myapp://profiles/{userId}/details/

But the second deep link will never be handled because these deep links are "equal" for navigation when it tries to find the best matching deep link. In this case, NavGraph will always use first matching NavDestination (profileFragment).

For example link myapp://profiles/u2/details/ will be handled as myapp://profils/{userId}/ where userId = u2/details.

There is a workaround - remove ending slash in second pattern to make patterns tails not matching:

myapp://profiles/{userId}/
myapp://profiles/{userId}/details

It works but it is not obvious.

Purposed solution

Make arguments to not include / character.

In resulting regexp: ^\Qmyapp://profiles/\E(.+?)\Q/\E($|(\?(.)*))
Replace: (.+?)
With: ([^/]+?)

If this solution is right, I can create pull request on GitHub.

Comments

jb...@google.com <jb...@google.com> #2Apr 2, 2021 02:33PM

Oh I forgot to mention that I thought it might be connected to this issue: https://issuetracker.google.com/issues/243778589. But after trying 2.5.2 I can say that the issue persists.

[Deleted User] <[Deleted User]> #3Apr 3, 2021 10:23AM

Please provide a minimal sample project along with the minimal steps to recreate the issue in the project.

[Deleted User] <[Deleted User]> #4Apr 13, 2021 09:57AM

Sorry for the delay. I got a working example here: https://github.com/Del-S/issues. The project is set up to crash when navigating to ThirdFragment (nested nav graph) with poping the graph.

I poked into it a little bit and it seems to be connected to SafeArgs gradle plugin. When safe args is used to navigate to ThirdFragment (with nested graph poped) it will try to recreate te parent but there were no arguments passed so it crashes.

Steps to reproduce:

Navigate from Second Fragment to Child nav graph (with non-nullable parameters).
Navigate to Third fragment using SafeArgs and the app crashes.

Crash log:

Process: cz.dels.issues, PID: 1743
java.lang.NullPointerException: null cannot be cast to non-null type kotlin.Long
at androidx.navigation.NavType$Companion$LongType$1.get(NavType.kt:352)
at androidx.navigation.NavType$Companion$LongType$1.get(NavType.kt:342)
at androidx.navigation.NavArgument.verify(NavArgument.kt:76)
at androidx.navigation.NavDestination.addInDefaultArgs(NavDestination.kt:502)
at androidx.navigation.NavController.addEntryToBackStack(NavController.kt:1865)
at androidx.navigation.NavController.addEntryToBackStack$default(NavController.kt:1813)
at androidx.navigation.NavController$navigate$4.invoke(NavController.kt:1721)
at androidx.navigation.NavController$navigate$4.invoke(NavController.kt:1719)
at androidx.navigation.NavController$NavControllerNavigatorState.push(NavController.kt:287)
at androidx.navigation.fragment.FragmentNavigator.navigate(FragmentNavigator.kt:246)
at androidx.navigation.fragment.FragmentNavigator.navigate(FragmentNavigator.kt:162)
at androidx.navigation.NavController.navigateInternal(NavController.kt:260)
at androidx.navigation.NavController.navigate(NavController.kt:1719)
at androidx.navigation.NavController.navigate(NavController.kt:1545)
at androidx.navigation.NavController.navigate(NavController.kt:1472)
at androidx.navigation.NavController.navigate(NavController.kt:1930)
at cz.dels.issues.SecondFragment.onViewCreated$lambda-0(SecondFragment.kt:38)
at cz.dels.issues.SecondFragment.$r8$lambda$XDYnOS_cYrafiNQ5rcCu1WCn0IE(Unknown Source:0)
at cz.dels.issues.SecondFragment$$ExternalSyntheticLambda0.onClick(Unknown Source:2)

Note: If in step 2 SaveArgs is not used then navigation works correctly. More information is here: https://github.com/Del-S/issues/blob/master/app/src/main/java/cz/dels/issues/SecondFragment.kt#L37.

ap...@google.com <ap...@google.com> #5Apr 15, 2021 06:58PM

Ups a typo: Navigate from ~~Second~~ First Fragment to Child nav graph (with non-nullable parameters).

Note: sorry for the spam but I am not able to edit my own comment.

il...@google.com <il...@google.com> May 4, 2021 08:05PM

Marked as fixed, reassigned to jb...@google.com.