如何修复不受保护的SMS BroadcastReceiver lint警告

Question

我的应用程序需要能够接收短信.一切正常,但我得到这个lint警告:

声明SMS_DELIVER或SMS_RECEIVED的intent-filter的BroadcastReceivers必须确保调用者具有BROADCAST_SMS权限,否则恶意actor可能会欺骗意图.

如何"确保调用者具有BROADCAST_SMS权限"？

在我的清单中我有:

<uses-permission android:name="android.permission.RECEIVE_SMS" />
<application ...>
    <receiver
        android:name=".SmsReceiver"
        android:enabled="true"
        android:exported="true">
        <intent-filter android:priority="1000">
            <action android:name="android.provider.Telephony.SMS_RECEIVED" />
        </intent-filter>
    </receiver>
</application>

我的代码:

public class SmsReceiver extends BroadcastReceiver {
    public SmsReceiver() {}

    @Override
    public void onReceive(final Context context, final Intent intent) {

        final Bundle bundle = intent.getExtras();
        if (bundle != null) {
            final Object[] pdusObj = (Object[]) bundle.get("pdus");
            for (int i = 0; i < pdusObj.length; i++) {
                final SmsMessage currentMessage = SmsMessage.createFromPdu((byte[]) pdusObj[i]);
                // use currentMessage
            }
        }
    }
}

Answer 1

添加android:permission="android.permission.BROADCAST_SMS"到开始<receiver>标记.

此外,组件默认启用,并<intent-filter>导出它,因此您不需要显式包含这些属性.

<receiver
    android:name=".SmsReceiver"
    android:permission="android.permission.BROADCAST_SMS">