Implicit PendingIntent漏洞修复求助：Android应用发布报错

问题分析 #

发布Android应用时触发Implicit PendingIntent漏洞报错，核心问题出在Scheduler类的createIntent()方法中：

• 使用隐式Intent（仅通过Action和Package匹配组件），存在被其他应用拦截的风险
• PendingIntent未使用符合Android 12+要求的安全Flag
• 固定的requestCode（0）可能导致Intent被意外覆盖

修复方案 #

针对上述问题，对createIntent()方法及相关逻辑做如下修改：

1. 将隐式Intent改为显式Intent #

直接指定目标BroadcastReceiver类，确保Intent只能被当前应用的Scheduler接收，避免隐式匹配风险。

2. 适配Android版本设置正确的PendingIntent Flag #

Android 12（API 31）及以上要求必须指定PendingIntent.FLAG_IMMUTABLE或FLAG_MUTABLE，这里场景不需要修改Intent内容，使用FLAG_IMMUTABLE保证安全性。

3. 优化requestCode避免Intent覆盖 #

使用固定的非零requestCode，避免与其他PendingIntent冲突，同时确保多次创建的同类型PendingIntent不会被意外覆盖。

修复后完整代码 #

import android.app.AlarmManager;
import android.app.PendingIntent;
import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.content.IntentFilter;
import android.os.Build;

import java.util.ArrayList;
import java.util.PriorityQueue;
import java.util.UUID;

import androidx.annotation.RequiresApi;

public class Scheduler extends BroadcastReceiver
{
    private final String EXECUTE_JOB = "org.strongswan.android.Scheduler.EXECUTE_JOB";
    private final Context mContext;
    private final AlarmManager mManager;
    private final PriorityQueue<ScheduledJob> mJobs;
    // 定义固定的requestCode，避免与其他PendingIntent冲突
    private static final int PENDING_INTENT_REQUEST_CODE = 1001;

    public Scheduler(Context context)
    {
        mContext = context;
        mManager = (AlarmManager)context.getSystemService(Context.ALARM_SERVICE);
        mJobs = new PriorityQueue<>();

        IntentFilter filter = new IntentFilter();
        filter.addAction(EXECUTE_JOB);
        mContext.registerReceiver(this, filter);
    }

    /**
     * Remove all pending jobs and unregister the receiver.
     * Called via JNI.
     */
    public void Terminate()
    {
        synchronized (this)
        {
            mJobs.clear();
        }
        mManager.cancel(createIntent());
        mContext.unregisterReceiver(this);
    }

    /**
     * Allocate a job ID. Called via JNI.
     *
     * @return random ID for a new job
     */
    public String allocateId()
    {
        return UUID.randomUUID().toString();
    }

    /**
     * Create a pending intent to execute a job.
     *
     * @return pending intent
     */
    private PendingIntent createIntent()
    {
        // 修改为显式Intent，直接指定当前Receiver类
        Intent intent = new Intent(mContext, Scheduler.class);
        intent.setAction(EXECUTE_JOB);
        intent.setPackage(mContext.getPackageName());
        
        // 根据Android版本设置正确的Flag
        int flags = 0;
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
            flags = PendingIntent.FLAG_IMMUTABLE;
        }
        
        // 使用固定的requestCode，避免Intent覆盖
        return PendingIntent.getBroadcast(mContext, PENDING_INTENT_REQUEST_CODE, intent, flags);
    }

    /**
     * Schedule executing a job in the future.
     * Called via JNI from different threads.
     *
     * @param id job ID
     * @param ms delta in milliseconds when the job should be executed
     */
    @RequiresApi(api = Build.VERSION_CODES.M)
    public void scheduleJob(String id, long ms)
    {
        synchronized (this)
        {
            ScheduledJob job = new ScheduledJob(id, System.currentTimeMillis() + ms);
            mJobs.add(job);

            if (job == mJobs.peek())
            {   /* update the alarm if the job has to be executed before all others */
                PendingIntent pending = createIntent();
                mManager.setExactAndAllowWhileIdle(AlarmManager.RTC_WAKEUP, job.Time, pending);
            }
        }
    }

    @RequiresApi(api = Build.VERSION_CODES.M)
    @Override
    public void onReceive(Context context, Intent intent)
    {
        ArrayList<ScheduledJob> jobs = new ArrayList<>();
        long now = System.currentTimeMillis();

        synchronized (this)
        {
            ScheduledJob job = mJobs.peek();
            while (job != null)
            {
                if (job.Time > now)
                {
                    break;
                }
                jobs.add(mJobs.remove());
                job = mJobs.peek();
            }
            if (job != null)
            {
                PendingIntent pending = createIntent();
                mManager.setExactAndAllowWhileIdle(AlarmManager.RTC_WAKEUP, job.Time, pending);
            }
        }

        for (ScheduledJob job : jobs)
        {
            executeJob(job.Id);
        }
    }

    /**
     * Execute the job with the given ID.
     *
     * @param id job ID
     */
    public native void executeJob(String id);

    /**
     * Keep track of scheduled jobs.
     */
    private static class ScheduledJob implements Comparable<ScheduledJob>
    {
        String Id;
        long Time;

        ScheduledJob(String id, long time)
        {
            Id = id;
            Time = time;
        }

        @Override
        public int compareTo(ScheduledJob o)
        {
            return Long.compare(Time, o.Time);
        }
    }
}

修复说明 #

• 显式Intent通过new Intent(mContext, Scheduler.class)直接绑定目标组件，彻底消除隐式Intent的安全风险
• 适配Android 12+的Flag要求，使用FLAG_IMMUTABLE保证PendingIntent不可修改，符合Google的安全规范
• 固定的requestCode避免了多次创建PendingIntent时的覆盖问题，确保AlarmManager能正确触发对应的任务

内容的提问来源于stack exchange，提问作者Mete Oğuzhan Bayrampınar