---

name: android-legacy-security description: Harden Intent handling, WebView configuration, and FileProvider access in Android apps. Use when securing Intent extras, configuring WebViews, or exposing files via FileProvider; defer manifest export flags and generic Bundle typing to focused Android security guidance. metadata: triggers: files: - '/*Activity.kt' - '/WebView.kt' - 'AndroidManifest.xml' keywords: - Intent - WebView - FileProvider - javaScriptEnabled

Android Legacy Security Standards

Priority: P0 (CRITICAL)

1. Secure Intents and Components

• Set android:exported="false" for all internal Activities/Services unless needed for deep links.
• Verify resolveActivity before starting implicit intents.
• Treat all incoming Intent extras as untrusted — validate all schema/data types.

See hardening examples for manifest and component restrictions.

2. Lock Down WebViews

• Default to javaScriptEnabled = false. Use WebViewClient and WebChromeClient to restrict navigation.
• Disable allowFileAccess and allowFileAccessFromFileURLs to prevent local file theft via XSS.
• If using @JavascriptInterface (API 17+), strictly limit exposed API surface.

See hardening examples for WebView lockdown patterns.

3. Protect Storage and Files

• NEVER expose file:// URIs. Use FileProvider to generate content:// URIs with temporary permissions.
• Use EncryptedSharedPreferences for auth tokens and PII. Never use legacy public-read file modes.
• Use NetworkSecurityConfig to disable cleartextTrafficPermitted and implement certificate pinning.

Anti-Patterns

• No Implicit Intents Internally: Use explicit intents with component class name.
• No Public Read Modes: Never expose SharedPreferences or files with global read access.

References

• Hardening Examples