You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@cordova.apache.org by GitBox <gi...@apache.org> on 2022/11/15 06:31:59 UTC
[GitHub] [cordova-android] zfir opened a new issue, #1518: singleTask Launch Mode Problem
zfir opened a new issue, #1518:
URL: https://github.com/apache/cordova-android/issues/1518
Hello
I have been developing an application that opens deeplinks. When using multiple deeplinks, there are multiple instances of the application that is created.
I have found a way to fix that by configuring the launchMode attribute to singleTask. The only problem is that there are some security issues using that(https://developer.android.com/guide/topics/manifest/activity-element)
I wanted to know if there is any other fix for that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
[GitHub] [cordova-android] breautek commented on issue #1518: singleTask Launch Mode Problem
Posted by GitBox <gi...@apache.org>.
breautek commented on issue #1518:
URL: https://github.com/apache/cordova-android/issues/1518#issuecomment-1315222644
>The only problem is that there are some security issues using that
Can you point out the security issue with using `singleTask`? I'm not seeing any mention of security problems when using any of the [launch modes](https://developer.android.com/guide/topics/manifest/activity-element#lmode). Just that some launch modes are not for general use because they may behave differently than what most users would expect.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
[GitHub] [cordova-android] breautek closed issue #1518: singleTask Launch Mode Problem
Posted by GitBox <gi...@apache.org>.
breautek closed issue #1518: singleTask Launch Mode Problem
URL: https://github.com/apache/cordova-android/issues/1518
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
[GitHub] [cordova-android] zfir commented on issue #1518: singleTask Launch Mode Problem
Posted by GitBox <gi...@apache.org>.
zfir commented on issue #1518:
URL: https://github.com/apache/cordova-android/issues/1518#issuecomment-1315299294
Hello @breautek,
Based on a pentest that we have done on our application, an issue has been raised concerning the launch mode `singleTask`. You can find how to hijack an android activity when using this launch mode based on this post: https://medium.com/mobis3c/android-task-hijacking-6a3a8848f16e#:~:text=For%20the%20attack%20described%20here%2C%20we%20are%20mostly%20concerned%20with%20the%20%E2%80%9CsingleTask%E2%80%9D%20mode.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
[GitHub] [cordova-android] breautek commented on issue #1518: singleTask Launch Mode Problem
Posted by GitBox <gi...@apache.org>.
breautek commented on issue #1518:
URL: https://github.com/apache/cordova-android/issues/1518#issuecomment-1315398481
Ok, the article also states several remediations to the `singleTask` problem, one of which is using `singleInstance` instead.
The problems noted with `singleTask` (which I think is the intended behaviour of that mode and thus isn't treated as a security vulnerability) is that the the task can be shared with several different activities. If you're aiming to guarantee only a single instance of your activity however, `singleTask` is not the solution as it conditionally allows multiple instances.
`singleInstance` is the only launch mode that guarentees a single instance of your activity, but it also enforces that there are no other tasks (the activity itself must be the only task) which might be problematic if you rely on Intents.
These are quite advanced topics, so I suggest reading the [Android](https://developer.android.com/guide/topics/manifest/activity-element#lmode) for your different launch mode options. You can confgure cordova to use them using `<preference name="AndroidLaunchMode" value="<mode>" />` in your `config.xml`. Each of the modes have their pros & cons.
I'm closing this issue because there is no clear bug with Cordova and we expose options to change the launch mode.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org