Comments (6)
iainmcgin
commented on June 14, 2024
FYI @StanKocken @nerdyverde, I'm working to patch this and release 0.3.0 ASAP based on my suggested approach above.
from openyolo-android.
iainmcgin
commented on June 14, 2024
I should actually make clear that this vulnerability is not currently triggered in the 0.2.1 release - the vulnerability only exists if the client actually reads the intent extra data - the extra data bundle is lazy-loaded by the implementation of Intent, and we do not currently look at the Intent data. However, out of an abundance of caution I want to close off the possibility that this will ever be an issue by changing the protocol as described.
from openyolo-android.
nerdyverde
commented on June 14, 2024
Changing the handling now so that this can't be an issue in the future makes sense to me.
from openyolo-android.
iainmcgin
commented on June 14, 2024
Patch is in.
from openyolo-android.
dxslly
commented on June 14, 2024
We should keep this open or open a new issue to track the removal of the client using the deprecated response intent.
from openyolo-android.
iainmcgin
commented on June 14, 2024
Let's open a new issue.
from openyolo-android.
Related Issues (20)
- Document interactions with Android O's Autofill HOT 15
- CredentialClient.getDeleteResult() should be getCredentialDeleteResult()
- Gradle Error when following the getting started guide when using Android Studio 2.x HOT 1
- Remove backwards compatibility with old BBQ retrieve Intents HOT 2
- Cleanup: utilize ProviderResolver in CredentialClient
- Feedback on demo app HOT 5
- Library uses Java 8 which makes integration difficult HOT 4
- Android Studio auto complete shows Protobuf package too HOT 2
- Proguard exclusion is too broad HOT 2
- Demo app is not working as intended HOT 2
- Confusing behaviuor or bug in providers? HOT 6
- Helper method to find out is any supported provider available? HOT 3
- Test app OpenYOLO Get credential button not working HOT 1
- Tapping the provider picker quickly after it is shown causes it to be dismissed HOT 1
- Crash due to IncompatibleClassChangeError: org.hamcrest.core.IsNull HOT 2
- Crash java.lang.ExceptionInInitializerError HOT 1
- RuntimeException in sample code HOT 1
- Can't delete credentials in Google Smart Lock HOT 1
- Unknown retrieve response in Test app HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from openyolo-android.