If Your Activity Has an <intent-filter>, Export It
Slightly less than two years ago, I pointed out a problem
in Android where an activity that has an <intent-filter>, but
is marked as not being exported (android:exported="false"),
screws up the chooser. The chooser ignores the exported flag and
offers up the non-exported activity to the user… then promptly
crashes if the user actually chooses it.
Dianne Hackborn specifically called this out as being a bug in the app:
would generally consider this a bug in the app – if you have an activity that you aren’t allowing other apps to launch, why the heck are you publishing an intent filter that they will match to try to launch?
What would be nice, of course, is if Google paid attention to its own advice.
The AOSP Music app has five activities that violate this rule:
VideoBrowserActivityArtistAlbumBrowserActivityAlbumBrowserActivityNowPlayingActivityTrackBrowserActivity
As a result, apps trying to start activities that match the
<intent-filter> will crash with a SecurityException. I
filed an issue about this
over six months ago, with no response to date.
The lesson to you is: don’t be like Google. Instead, be like Google.
If your activity should not be visible to third parties, simply
drop the <intent-filter> and use an explicit Intent to start
it. You can still include things like an action string on the
Intent, but use the explicit class or ComponentName control
the routing of the Intent. Dropping the <intent-filter> will
cause your activity to be non-exported by default, and you will
not show up in choosers when you are not an eligible option.
I still would like the chooser to take permissions, exported status, etc. into account. Maybe I’ll write my own chooser someday…
