인텐트 안정성 문제입니다.

Question

제가 aidl 서비를 생성하여 두개를 앱으로 값을 보내고있는데요 그 값을 받는 앱이 aidl서비스에 bind를 하면

 

A app  -> B app

A.pp AndroidManifest 에는 필터 등록을 했습니다.

W/ContextImpl(9543): Implicit intents with startService are not safe:

이런메시지가 나오는데요. 인텐트가 안전하지 않다 이러는거 같은데.. 이걸 해결하는 방법 이있을까요??

바인드는 B app에서

bindService(new Intent(클래스명), mServiceConnection, Context.BIND_AUTO_CREATE);

이런식으로 하고있습니다. 위치는 onCreate에서 하고 있고요

Answer 1

Intent에 class 명 말고 action 값으로 처리 해보심이.

bindService(new Intent("com.my.action"), mServiceConnection, Context.BIND_AUTO_CREATE);

받는쪽 app Manifest.xml 파일

<service ...>
    <intent-filter>
        <action android:name="com.my.action" />
        <category android:name="... DEFAULT"/>
    </intent-filter>
</service>

 

Comments

제가 이상하게 하고 있는 건지... 그렇게 해도 똑같은 상황이네요..
답변 감사합니다.

Answer 2

http://developer.android.com/training/articles/security-tips.html#StoringData

안드로이드 개발사이트에서 아래 내용이 있습니다. 참고하세요 !

 

Using binder and messenger interfaces

Using Binder or Messenger is the preferred mechanism for RPC-style IPC in Android. They provide a well-defined interface that enables mutual authentication of the endpoints, if required.

We strongly encourage designing interfaces in a manner that does not require interface specific permission checks. Binder and Messenger objects are not declared within the application manifest, and therefore you cannot apply declarative permissions directly to them. They generally inherit permissions declared in the application manifest for the Service or Activity within which they are implemented. If you are creating an interface that requires authentication and/or access controls, those controls must be explicitly added as code in the Binder or Messenger interface.

If providing an interface that does require access controls, use checkCallingPermission() to verify whether the caller has a required permission. This is especially important before accessing a service on behalf of the caller, as the identify of your application is passed to other interfaces. If invoking an interface provided by a Service, the bindService() invocation may fail if you do not have permission to access the given service. If calling an interface provided locally by your own application, it may be useful to use the clearCallingIdentity() to satisfy internal security checks.

For more information about performing IPC with a service, see Bound Services