Android 12: Security and privacy - Pending intents mutability #16082

ashiagr · 2022-03-10T14:04:58Z

References: Automattic/stories-android#721

This PR includes the following changes:

Update PendingIntent flags to include the mutability flag as part of Android 12 migration changes for notifications and widgets (see Details section).
Upgrade androidxWorkVersion to 2.7.0 that fixes a platform bug causing pending intent crash on targetSdkVersion 31 (2a2f7f0, 3441794)
Two refactoring commits (faa4288, 38f57bb) that formats files and removes unnecessary version check at places where pending intent flags were introduced.

Details:

List of all the notification types used in the app and classes setting pending intent mutability for them:

Class	NotificationType	Notes
GCMMessageHandler (via `NotificationHelper.handleDefaultPush`)	COMMENT	Supports direct reply actions
	LIKE
	COMMENT_LIKE
	AUTOMATTCHER
	FOLLOW
	REBLOG
	BADGE_RESET
	NOTE_DELETE
	TEST_NOTE
	ZENDESK
	UNKNOWN_NOTE
	AUTHENTICATION
	GROUP_NOTIFICATION
NotificationsProcessingService	ACTIONS_RESULT
	ACTIONS_PROGRESS
NotificationsPendingDraftsReceiver, PendingDraftsNotificationsUtils (draft posts)	PENDING_DRAFTS	Uses `AlarmManager`
QuickStartReminderReceiver, QuickStartUtils	QUICK_START_REMINDER	Uses `AlarmManager`
PostUploadNotifier	POST_UPLOAD_SUCCESS
	POST_UPLOAD_ERROR
	MEDIA_UPLOAD_SUCCESS
	MEDIA_UPLOAD_ERROR
PublishSettingsFragment (scheduled posts)	POST_PUBLISHED	Uses `AlarmManager`
FrameSaveNotifier (storis lib)	STORY_SAVE_SUCCESS
	STORY_SAVE_ERROR
	STORY_FRAME_SAVE_SUCCESS
	STORY_FRAME_SAVE_ERROR
ReminderNotifier	BLOGGING_REMINDERS	Uses `WorkManager`
LocalNotificationWorker	CREATE_SITE	Uses `WorkManager`
	WEEKLY_ROUNDUP	Uses `WorkManager`

Additionally, WidgetUtils sets pending intent mutability for Stats widgets.

It is important that pending intents mutability for all notifications and widgets are correctly set. Quoting the doc:

In most cases, your app should create immutable PendingIntent objects,....
However, certain use cases require mutable PendingIntent objects instead:

Supporting direct reply actions in notifications.
....

Scheduling alarms using AlarmManager. The mutable PendingIntent object allows the system to add the EXTRA_ALARM_COUNT intent extra. This extra represents the number of times that a repeating alarm has been triggered. By containing this extra, the intent can accurately notify an app as to whether a repeating alarm was triggered multiple times, such as when the device was asleep.

For the reasons above, all pending intents are made immutable (8176ba3) except for comments notifications that allow direct replies and voice remote input (76d8c36).

For the notifications using AlarmManager (PENDING_DRAFTS, QUICK_START_REMINDER, POST_PUBLISHED), it seems we do not need a mutable pending intent as they're not repeating alarms.

To test:

Make sure that at least the special notifications have their pending intent mutability set correctly.

Test.1 Comments

Login using a wpcom account having sites on your device
Comment on a site post using another account from Calypso
Wait for the comment notification to arrive on the device
Expand the notification and direct reply to the comment from the notification
Notice that the comment is posted properly

Test.2 Quick Start Reminders

Fresh launch the app
Select a site from the epilogue view
When the Quick Start Prompt is shown, tap the "Show me around" option
Tap the Customize your site row to launch the QS dialog
Tap on Check your site title (the dialog will close and you'll be brought back to My Site)
Tap on the blue flashing icon on site title and change the text
Notifications are set for two days in the future, so you have to change the date/time on the device for testing
Navigate out of the app to the Settings area of your device and locate the area that manages the time.
Disable the "use network-provided time"
Manually set the date/time for 2 days and 2 minutes from now
NOTE: The notification should arrive at the device within a couple of minutes
After the notification is shown - don't forget to enable "use network-provided time"

Test.3 Post Published

Launch the app
Click FAB to create a post to schedule it for a future time
Go to Post Settings
Go to Publish Date
Set Publish Date two minutes in the future
Set Notification to when published
Navigate out of the app
The notification should arrive at the device within a couple of minutes

Test.4 Adhoc Notification

If you suspect any other notification (from the notifications table above) should have a pending intent mutability other than what is set, test it out or test for a random notification type.

Note that PENDING_DRAFTS notifications are not displayed due to an existing bug: #14240

Test.5 Stats Widgets

Go to your Home and try to add a Widget
Scroll to the WordPress
Add Stats widget (you'll need to select a site as an intermediate step)
Interact with the widget
Make sure everything works as expected

Merge Instructions

~~Make sure that referenced Stories Lib PR is merged to trunk~~
~~Update Stories Lib version from trunk~~
~~Remove Not Ready for Merge label~~
~~Merge the PR~~

Regression Notes

Potential unintended areas of impact
Push notifications
What I did to test those areas of impact (or what existing automated tests I relied on)
See To Test section
What automated tests I added (or what prevented me from doing so) - N/A

PR submission checklist:

I have completed the Regression Notes.
I have considered adding accessibility improvements for my changes.
I have considered if this change warrants user-facing release notes and have added them to RELEASE-NOTES.txt if necessary.

…RSION_CODES.N

…f Android 12 migration changes

PendingIntent that contains a RemoteInput requires a mutable flag. Comments can have voice reply enabled which will come through the remoteInput (EXTRA_VOICE_OR_INLINE_REPLY) For more details, see: https://issuetracker.google.com/issues/204328125

This version fixes a platform bug causing pending intent crash on targetSdkVersion 31. For more details, see: https://issuetracker.google.com/issues/194108978

…ter upgrading to 2.7.0 For more details, see: https://developer.android.com/topic/libraries/architecture/workmanager/advanced/custom-configuration#remove-default

This commit updates immutable pending intent flag to stories lib > FrameSaveNotifier

peril-wordpress-mobile · 2022-03-10T14:05:06Z

You can trigger optional UI/connected tests for these changes by visiting CircleCI here.

peril-wordpress-mobile · 2022-03-10T14:28:30Z

You can test the changes on this Pull Request by downloading the APKs:

Jetpack-pr-16082-build-119816.apk

WordPress-pr-16082-build-119816.apk

ravishanker

I did a quick smoke test of flows and notifications.
Great effort. Thanks for making this happen! 🙇🏻‍♂️

ravishanker · 2022-03-21T04:48:30Z

Please feel free to merge this after resolving conflicts. Make sure to pull-in latest trunk as I noticed it required me to uninstall the previous due to database upgrade.

# Conflicts: # build.gradle

peril-wordpress-mobile · 2022-03-22T04:23:55Z

	Warnings
⚠️	PR has more than 300 lines of code changing. Consider splitting into smaller PRs if possible.

Generated by 🚫 dangerJS

Revert androidxWorkVersion

wpmobilebot · 2022-03-22T04:42:27Z

Found 1 violations:

The PR caused the following dependency changes:

-+--- com.automattic:stories:1.2.1
-|    +--- androidx.databinding:viewbinding:4.2.2 (*)
-|    +--- org.jetbrains.kotlin:kotlin-parcelize-runtime:1.4.20 -> 1.5.32 (*)
-|    +--- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.4.20 -> 1.5.32 (*)
-|    +--- org.jetbrains.kotlinx:kotlinx-serialization-runtime:1.0-M1-1.4.0-rc
-|    |    \--- org.jetbrains.kotlinx:kotlinx-serialization-runtime-jvm:1.0-M1-1.4.0-rc
-|    |         +--- org.jetbrains.kotlin:kotlin-stdlib:1.4.0-rc -> 1.6.0 (*)
-|    |         \--- org.jetbrains.kotlin:kotlin-stdlib-common:1.4.0-rc -> 1.6.0
-|    +--- org.jetbrains.kotlin:kotlin-reflect:1.4.20
-|    |    \--- org.jetbrains.kotlin:kotlin-stdlib:1.4.20 -> 1.6.0 (*)
-|    +--- androidx.appcompat:appcompat:1.0.2 -> 1.3.1 (*)
-|    +--- androidx.constraintlayout:constraintlayout:1.1.3 -> 2.0.4 (*)
-|    +--- androidx.core:core-ktx:1.2.0 -> 1.7.0 (*)
-|    +--- androidx.navigation:navigation-fragment-ktx:2.0.0 -> 2.3.5
-|    |    +--- androidx.navigation:navigation-fragment:2.3.5
-|    |    |    +--- androidx.fragment:fragment:1.2.4 -> 1.3.6 (*)
-|    |    |    \--- androidx.navigation:navigation-runtime:2.3.5 -> 2.4.0-beta02 (*)
-|    |    +--- androidx.navigation:navigation-runtime-ktx:2.3.5 -> 2.4.0-beta02 (*)
-|    |    +--- androidx.fragment:fragment-ktx:1.2.4
-|    |    |    +--- org.jetbrains.kotlin:kotlin-stdlib:1.3.50 -> 1.6.0 (*)
-|    |    |    +--- androidx.fragment:fragment:1.2.4 -> 1.3.6 (*)
-|    |    |    +--- androidx.activity:activity-ktx:1.1.0 -> 1.3.1 (*)
-|    |    |    +--- androidx.core:core-ktx:1.1.0 -> 1.7.0 (*)
-|    |    |    +--- androidx.collection:collection-ktx:1.1.0 (*)
-|    |    |    +--- androidx.lifecycle:lifecycle-livedata-core-ktx:2.2.0
-|    |    |    |    +--- org.jetbrains.kotlin:kotlin-stdlib:1.3.50 -> 1.6.0 (*)
-|    |    |    |    \--- androidx.lifecycle:lifecycle-livedata-core:2.2.0 -> 2.3.1 (*)
-|    |    |    \--- androidx.lifecycle:lifecycle-viewmodel-ktx:2.2.0 -> 2.3.1 (*)
-|    |    +--- androidx.lifecycle:lifecycle-viewmodel-ktx:2.2.0 -> 2.3.1 (*)
-|    |    \--- org.jetbrains.kotlin:kotlin-stdlib:1.3.71 -> 1.6.0 (*)
-|    +--- androidx.navigation:navigation-ui-ktx:2.0.0 -> 2.3.5
-|    |    +--- androidx.navigation:navigation-ui:2.3.5
-|    |    |    +--- androidx.navigation:navigation-runtime:2.3.5 -> 2.4.0-beta02 (*)
-|    |    |    +--- androidx.customview:customview:1.1.0 (*)
-|    |    |    +--- androidx.drawerlayout:drawerlayout:1.1.1 (*)
-|    |    |    +--- com.google.android.material:material:1.0.0 -> 1.6.0-alpha01 (*)
-|    |    |    \--- androidx.transition:transition:1.3.0 (*)
-|    |    +--- androidx.navigation:navigation-runtime-ktx:2.3.5 -> 2.4.0-beta02 (*)
-|    |    \--- org.jetbrains.kotlin:kotlin-stdlib:1.3.71 -> 1.6.0 (*)
-|    +--- androidx.emoji:emoji:1.0.0
-|    |    \--- androidx.core:core:1.0.0 -> 1.7.0 (*)
-|    +--- androidx.recyclerview:recyclerview:1.1.0 (*)
-|    +--- com.google.android.material:material:1.2.1 -> 1.6.0-alpha01 (*)
-|    +--- com.github.bumptech.glide:glide:4.10.0 -> 4.11.0
-|    |    +--- com.github.bumptech.glide:gifdecoder:4.11.0
-|    |    |    \--- androidx.annotation:annotation:1.0.0 -> 1.2.0
-|    |    +--- com.github.bumptech.glide:disklrucache:4.11.0
-|    |    +--- com.github.bumptech.glide:annotations:4.11.0
-|    |    +--- androidx.fragment:fragment:1.0.0 -> 1.3.6 (*)
-|    |    +--- androidx.vectordrawable:vectordrawable-animated:1.0.0 -> 1.1.0 (*)
-|    |    \--- androidx.exifinterface:exifinterface:1.0.0 -> 1.1.0-beta01
-|    |         \--- androidx.annotation:annotation:1.1.0 -> 1.2.0
-|    +--- jp.wasabeef:glide-transformations:4.3.0
-|    |    \--- com.github.bumptech.glide:glide:4.11.0 (*)
-|    +--- org.greenrobot:eventbus:3.3.1
-|    |    \--- org.greenrobot:eventbus-java:3.3.1
-|    +--- com.automattic.stories:photoeditor:1.2.1
-|    |    +--- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.4.20 -> 1.5.32 (*)
-|    |    +--- org.jetbrains.kotlinx:kotlinx-serialization-runtime:1.0-M1-1.4.0-rc (*)
-|    |    +--- androidx.appcompat:appcompat:1.0.2 -> 1.3.1 (*)
-|    |    +--- androidx.core:core-ktx:1.2.0 -> 1.7.0 (*)
-|    |    +--- androidx.camera:camera-core:1.0.0-alpha06
-|    |    |    +--- com.google.auto.value:auto-value-annotations:1.6.3
-|    |    |    +--- com.google.guava:listenablefuture:1.0 -> 9999.0-empty-to-avoid-conflict-with-guava
-|    |    |    +--- androidx.lifecycle:lifecycle-livedata:2.1.0 -> 2.2.0 (*)
-|    |    |    +--- androidx.lifecycle:lifecycle-common:2.1.0 -> 2.3.1 (*)
-|    |    |    +--- androidx.exifinterface:exifinterface:1.0.0 -> 1.1.0-beta01 (*)
-|    |    |    +--- androidx.annotation:annotation:1.0.0 -> 1.2.0
-|    |    |    +--- androidx.core:core:1.1.0 -> 1.7.0 (*)
-|    |    |    \--- androidx.concurrent:concurrent-futures:1.0.0-alpha03 -> 1.0.0 (*)
-|    |    +--- androidx.camera:camera-camera2:1.0.0-alpha06
-|    |    |    +--- com.google.guava:listenablefuture:1.0 -> 9999.0-empty-to-avoid-conflict-with-guava
-|    |    |    +--- androidx.camera:camera-core:1.0.0-alpha06 (*)
-|    |    |    +--- androidx.core:core:1.1.0 -> 1.7.0 (*)
-|    |    |    +--- androidx.annotation:annotation:1.0.0 -> 1.2.0
-|    |    |    \--- androidx.concurrent:concurrent-futures:1.0.0-alpha03 -> 1.0.0 (*)
-|    |    +--- org.jetbrains.kotlinx:kotlinx-coroutines-core:1.3.9 -> 1.5.2 (*)
-|    |    +--- com.google.android.material:material:1.2.1 -> 1.6.0-alpha01 (*)
-|    |    +--- com.github.bumptech.glide:glide:4.10.0 -> 4.11.0 (*)
-|    |    +--- jp.wasabeef:glide-transformations:4.3.0 (*)
-|    |    +--- com.github.chrisbanes:PhotoView:2.3.0
-|    |    |    \--- androidx.appcompat:appcompat:1.0.0 -> 1.3.1 (*)
-|    |    +--- com.automattic.stories:mp4compose:1.2.1
-|    |    |    +--- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.4.20 -> 1.5.32 (*)
-|    |    |    \--- com.github.bumptech.glide:glide:4.10.0 -> 4.11.0 (*)
-|    |    \--- androidx.emoji:emoji:1.0.0 (*)
-|    +--- androidx.lifecycle:lifecycle-common-java8:2.2.0 -> 2.3.0 (*)
-|    +--- androidx.lifecycle:lifecycle-viewmodel-ktx:2.2.0 -> 2.3.1 (*)
-|    +--- androidx.lifecycle:lifecycle-livedata-ktx:2.2.0
-|    |    +--- org.jetbrains.kotlin:kotlin-stdlib:1.3.50 -> 1.6.0 (*)
-|    |    +--- org.jetbrains.kotlinx:kotlinx-coroutines-core:1.3.0 -> 1.5.2 (*)
-|    |    +--- androidx.lifecycle:lifecycle-livedata:2.2.0 (*)
-|    |    \--- androidx.lifecycle:lifecycle-livedata-core-ktx:2.2.0 (*)
-|    +--- org.jetbrains.kotlinx:kotlinx-coroutines-core:1.3.9 -> 1.5.2 (*)
-|    \--- com.github.chrisbanes:PhotoView:2.3.0 (*)
++--- com.automattic:stories:trunk-2f8aaff7fb03bdbd0e2efbe111626bf3c6a7aa44
+|    +--- androidx.databinding:viewbinding:4.2.2 (*)
+|    +--- org.jetbrains.kotlin:kotlin-parcelize-runtime:1.4.20 -> 1.5.32 (*)
+|    +--- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.4.20 -> 1.5.32 (*)
+|    +--- org.jetbrains.kotlinx:kotlinx-serialization-runtime:1.0-M1-1.4.0-rc
+|    |    \--- org.jetbrains.kotlinx:kotlinx-serialization-runtime-jvm:1.0-M1-1.4.0-rc
+|    |         +--- org.jetbrains.kotlin:kotlin-stdlib:1.4.0-rc -> 1.6.0 (*)
+|    |         \--- org.jetbrains.kotlin:kotlin-stdlib-common:1.4.0-rc -> 1.6.0
+|    +--- org.jetbrains.kotlin:kotlin-reflect:1.4.20
+|    |    \--- org.jetbrains.kotlin:kotlin-stdlib:1.4.20 -> 1.6.0 (*)
+|    +--- androidx.appcompat:appcompat:1.0.2 -> 1.3.1 (*)
+|    +--- androidx.constraintlayout:constraintlayout:1.1.3 -> 2.0.4 (*)
+|    +--- androidx.core:core-ktx:1.2.0 -> 1.7.0 (*)
+|    +--- androidx.navigation:navigation-fragment-ktx:2.0.0 -> 2.3.5
+|    |    +--- androidx.navigation:navigation-fragment:2.3.5
+|    |    |    +--- androidx.fragment:fragment:1.2.4 -> 1.3.6 (*)
+|    |    |    \--- androidx.navigation:navigation-runtime:2.3.5 -> 2.4.0-beta02 (*)
+|    |    +--- androidx.navigation:navigation-runtime-ktx:2.3.5 -> 2.4.0-beta02 (*)
+|    |    +--- androidx.fragment:fragment-ktx:1.2.4
+|    |    |    +--- org.jetbrains.kotlin:kotlin-stdlib:1.3.50 -> 1.6.0 (*)
+|    |    |    +--- androidx.fragment:fragment:1.2.4 -> 1.3.6 (*)
+|    |    |    +--- androidx.activity:activity-ktx:1.1.0 -> 1.3.1 (*)
+|    |    |    +--- androidx.core:core-ktx:1.1.0 -> 1.7.0 (*)
+|    |    |    +--- androidx.collection:collection-ktx:1.1.0 (*)
+|    |    |    +--- androidx.lifecycle:lifecycle-livedata-core-ktx:2.2.0
+|    |    |    |    +--- org.jetbrains.kotlin:kotlin-stdlib:1.3.50 -> 1.6.0 (*)
+|    |    |    |    \--- androidx.lifecycle:lifecycle-livedata-core:2.2.0 -> 2.3.1 (*)
+|    |    |    \--- androidx.lifecycle:lifecycle-viewmodel-ktx:2.2.0 -> 2.3.1 (*)
+|    |    +--- androidx.lifecycle:lifecycle-viewmodel-ktx:2.2.0 -> 2.3.1 (*)
+|    |    \--- org.jetbrains.kotlin:kotlin-stdlib:1.3.71 -> 1.6.0 (*)
+|    +--- androidx.navigation:navigation-ui-ktx:2.0.0 -> 2.3.5
+|    |    +--- androidx.navigation:navigation-ui:2.3.5
+|    |    |    +--- androidx.navigation:navigation-runtime:2.3.5 -> 2.4.0-beta02 (*)
+|    |    |    +--- androidx.customview:customview:1.1.0 (*)
+|    |    |    +--- androidx.drawerlayout:drawerlayout:1.1.1 (*)
+|    |    |    +--- com.google.android.material:material:1.0.0 -> 1.6.0-alpha01 (*)
+|    |    |    \--- androidx.transition:transition:1.3.0 (*)
+|    |    +--- androidx.navigation:navigation-runtime-ktx:2.3.5 -> 2.4.0-beta02 (*)
+|    |    \--- org.jetbrains.kotlin:kotlin-stdlib:1.3.71 -> 1.6.0 (*)
+|    +--- androidx.emoji:emoji:1.0.0
+|    |    \--- androidx.core:core:1.0.0 -> 1.7.0 (*)
+|    +--- androidx.recyclerview:recyclerview:1.1.0 (*)
+|    +--- com.google.android.material:material:1.2.1 -> 1.6.0-alpha01 (*)
+|    +--- com.github.bumptech.glide:glide:4.10.0 -> 4.11.0
+|    |    +--- com.github.bumptech.glide:gifdecoder:4.11.0
+|    |    |    \--- androidx.annotation:annotation:1.0.0 -> 1.2.0
+|    |    +--- com.github.bumptech.glide:disklrucache:4.11.0
+|    |    +--- com.github.bumptech.glide:annotations:4.11.0
+|    |    +--- androidx.fragment:fragment:1.0.0 -> 1.3.6 (*)
+|    |    +--- androidx.vectordrawable:vectordrawable-animated:1.0.0 -> 1.1.0 (*)
+|    |    \--- androidx.exifinterface:exifinterface:1.0.0 -> 1.1.0-beta01
+|    |         \--- androidx.annotation:annotation:1.1.0 -> 1.2.0
+|    +--- jp.wasabeef:glide-transformations:4.3.0
+|    |    \--- com.github.bumptech.glide:glide:4.11.0 (*)
+|    +--- org.greenrobot:eventbus:3.3.1
+|    |    \--- org.greenrobot:eventbus-java:3.3.1
+|    +--- com.automattic.stories:photoeditor:trunk-2f8aaff7fb03bdbd0e2efbe111626bf3c6a7aa44
+|    |    +--- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.4.20 -> 1.5.32 (*)
+|    |    +--- org.jetbrains.kotlinx:kotlinx-serialization-runtime:1.0-M1-1.4.0-rc (*)
+|    |    +--- androidx.appcompat:appcompat:1.0.2 -> 1.3.1 (*)
+|    |    +--- androidx.core:core-ktx:1.2.0 -> 1.7.0 (*)
+|    |    +--- androidx.camera:camera-core:1.0.0-alpha06
+|    |    |    +--- com.google.auto.value:auto-value-annotations:1.6.3
+|    |    |    +--- com.google.guava:listenablefuture:1.0 -> 9999.0-empty-to-avoid-conflict-with-guava
+|    |    |    +--- androidx.lifecycle:lifecycle-livedata:2.1.0 -> 2.2.0 (*)
+|    |    |    +--- androidx.lifecycle:lifecycle-common:2.1.0 -> 2.3.1 (*)
+|    |    |    +--- androidx.exifinterface:exifinterface:1.0.0 -> 1.1.0-beta01 (*)
+|    |    |    +--- androidx.annotation:annotation:1.0.0 -> 1.2.0
+|    |    |    +--- androidx.core:core:1.1.0 -> 1.7.0 (*)
+|    |    |    \--- androidx.concurrent:concurrent-futures:1.0.0-alpha03 -> 1.0.0 (*)
+|    |    +--- androidx.camera:camera-camera2:1.0.0-alpha06
+|    |    |    +--- com.google.guava:listenablefuture:1.0 -> 9999.0-empty-to-avoid-conflict-with-guava
+|    |    |    +--- androidx.camera:camera-core:1.0.0-alpha06 (*)
+|    |    |    +--- androidx.core:core:1.1.0 -> 1.7.0 (*)
+|    |    |    +--- androidx.annotation:annotation:1.0.0 -> 1.2.0
+|    |    |    \--- androidx.concurrent:concurrent-futures:1.0.0-alpha03 -> 1.0.0 (*)
+|    |    +--- org.jetbrains.kotlinx:kotlinx-coroutines-core:1.3.9 -> 1.5.2 (*)
+|    |    +--- com.google.android.material:material:1.2.1 -> 1.6.0-alpha01 (*)
+|    |    +--- com.github.bumptech.glide:glide:4.10.0 -> 4.11.0 (*)
+|    |    +--- jp.wasabeef:glide-transformations:4.3.0 (*)
+|    |    +--- com.github.chrisbanes:PhotoView:2.3.0
+|    |    |    \--- androidx.appcompat:appcompat:1.0.0 -> 1.3.1 (*)
+|    |    +--- com.automattic.stories:mp4compose:trunk-2f8aaff7fb03bdbd0e2efbe111626bf3c6a7aa44
+|    |    |    +--- org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.4.20 -> 1.5.32 (*)
+|    |    |    \--- com.github.bumptech.glide:glide:4.10.0 -> 4.11.0 (*)
+|    |    \--- androidx.emoji:emoji:1.0.0 (*)
+|    +--- androidx.lifecycle:lifecycle-common-java8:2.2.0 -> 2.3.0 (*)
+|    +--- androidx.lifecycle:lifecycle-viewmodel-ktx:2.2.0 -> 2.3.1 (*)
+|    +--- androidx.lifecycle:lifecycle-livedata-ktx:2.2.0
+|    |    +--- org.jetbrains.kotlin:kotlin-stdlib:1.3.50 -> 1.6.0 (*)
+|    |    +--- org.jetbrains.kotlinx:kotlinx-coroutines-core:1.3.0 -> 1.5.2 (*)
+|    |    +--- androidx.lifecycle:lifecycle-livedata:2.2.0 (*)
+|    |    \--- androidx.lifecycle:lifecycle-livedata-core-ktx:2.2.0 (*)
+|    +--- org.jetbrains.kotlinx:kotlinx-coroutines-core:1.3.9 -> 1.5.2 (*)
+|    \--- com.github.chrisbanes:PhotoView:2.3.0 (*)
-+--- com.automattic.stories:mp4compose:1.2.1 (*)
++--- com.automattic.stories:mp4compose:trunk-2f8aaff7fb03bdbd0e2efbe111626bf3c6a7aa44 (*)
-+--- androidx.work:work-runtime:2.4.0
-|    +--- com.google.guava:listenablefuture:1.0 -> 9999.0-empty-to-avoid-conflict-with-guava
-|    +--- androidx.lifecycle:lifecycle-livedata:2.1.0 -> 2.2.0 (*)
-|    +--- androidx.room:room-runtime:2.2.5 -> 2.3.0
-|    |    +--- androidx.room:room-common:2.3.0
-|    |    |    \--- androidx.annotation:annotation:1.1.0 -> 1.2.0
-|    |    +--- androidx.sqlite:sqlite-framework:2.1.0
-|    |    |    +--- androidx.annotation:annotation:1.0.0 -> 1.2.0
-|    |    |    \--- androidx.sqlite:sqlite:2.1.0
-|    |    |         \--- androidx.annotation:annotation:1.0.0 -> 1.2.0
-|    |    +--- androidx.sqlite:sqlite:2.1.0 (*)
-|    |    +--- androidx.arch.core:core-runtime:2.0.1 -> 2.1.0 (*)
-|    |    \--- androidx.annotation:annotation-experimental:1.1.0
-|    +--- androidx.sqlite:sqlite:2.1.0 (*)
-|    +--- androidx.sqlite:sqlite-framework:2.1.0 (*)
-|    +--- androidx.core:core:1.1.0 -> 1.7.0 (*)
-|    \--- androidx.lifecycle:lifecycle-service:2.1.0 -> 2.2.0 (*)
++--- androidx.work:work-runtime:2.7.0
+|    +--- androidx.annotation:annotation-experimental:1.0.0 -> 1.1.0
+|    +--- com.google.guava:listenablefuture:1.0 -> 9999.0-empty-to-avoid-conflict-with-guava
+|    +--- androidx.lifecycle:lifecycle-livedata:2.1.0 -> 2.2.0 (*)
+|    +--- androidx.startup:startup-runtime:1.0.0 (*)
+|    +--- androidx.core:core:1.6.0 -> 1.7.0 (*)
+|    +--- androidx.room:room-runtime:2.2.5 -> 2.3.0
+|    |    +--- androidx.room:room-common:2.3.0
+|    |    |    \--- androidx.annotation:annotation:1.1.0 -> 1.2.0
+|    |    +--- androidx.sqlite:sqlite-framework:2.1.0
+|    |    |    +--- androidx.annotation:annotation:1.0.0 -> 1.2.0
+|    |    |    \--- androidx.sqlite:sqlite:2.1.0
+|    |    |         \--- androidx.annotation:annotation:1.0.0 -> 1.2.0
+|    |    +--- androidx.sqlite:sqlite:2.1.0 (*)
+|    |    +--- androidx.arch.core:core-runtime:2.0.1 -> 2.1.0 (*)
+|    |    \--- androidx.annotation:annotation-experimental:1.1.0
+|    +--- androidx.sqlite:sqlite:2.1.0 (*)
+|    +--- androidx.sqlite:sqlite-framework:2.1.0 (*)
+|    +--- androidx.core:core:1.1.0 -> 1.7.0 (*)
+|    \--- androidx.lifecycle:lifecycle-service:2.1.0 -> 2.2.0 (*)
-+--- androidx.work:work-runtime-ktx:2.4.0
-|    +--- androidx.work:work-runtime:2.4.0 (*)
-|    +--- org.jetbrains.kotlin:kotlin-stdlib:1.3.71 -> 1.6.0 (*)
-|    \--- org.jetbrains.kotlinx:kotlinx-coroutines-android:1.3.4 -> 1.5.2 (*)
++--- androidx.work:work-runtime-ktx:2.7.0
+|    +--- androidx.work:work-runtime:2.7.0 (*)
+|    +--- org.jetbrains.kotlin:kotlin-stdlib:1.5.30 -> 1.6.0 (*)
+|    \--- org.jetbrains.kotlinx:kotlinx-coroutines-android:1.5.0 -> 1.5.2 (*)
-\--- androidx.work:work-gcm:2.4.0
-     +--- androidx.work:work-runtime:2.4.0 (*)
-     +--- com.google.android.gms:play-services-gcm:17.0.0
-     |    +--- androidx.collection:collection:1.0.0 -> 1.1.0 (*)
-     |    +--- androidx.core:core:1.0.0 -> 1.7.0 (*)
-     |    +--- androidx.legacy:legacy-support-core-utils:1.0.0 (*)
-     |    +--- com.google.android.gms:play-services-base:17.0.0 -> 17.1.0
-     |    |    +--- androidx.collection:collection:1.0.0 -> 1.1.0 (*)
-     |    |    +--- androidx.core:core:1.0.0 -> 1.7.0 (*)
-     |    |    +--- androidx.fragment:fragment:1.0.0 -> 1.3.6 (*)
-     |    |    +--- com.google.android.gms:play-services-basement:17.0.0 -> 17.1.1
-     |    |    |    +--- androidx.collection:collection:1.0.0 -> 1.1.0 (*)
-     |    |    |    +--- androidx.core:core:1.0.0 -> 1.7.0 (*)
-     |    |    |    \--- androidx.fragment:fragment:1.0.0 -> 1.3.6 (*)
-     |    |    \--- com.google.android.gms:play-services-tasks:17.0.0
-     |    |         \--- com.google.android.gms:play-services-basement:17.0.0 -> 17.1.1 (*)
-     |    +--- com.google.android.gms:play-services-basement:17.0.0 -> 17.1.1 (*)
-     |    +--- com.google.android.gms:play-services-iid:17.0.0
-     |    |    +--- androidx.collection:collection:1.0.0 -> 1.1.0 (*)
-     |    |    +--- androidx.core:core:1.0.0 -> 1.7.0 (*)
-     |    |    +--- com.google.android.gms:play-services-base:17.0.0 -> 17.1.0 (*)
-     |    |    +--- com.google.android.gms:play-services-basement:17.0.0 -> 17.1.1 (*)
-     |    |    +--- com.google.android.gms:play-services-stats:17.0.0
-     |    |    |    +--- androidx.legacy:legacy-support-core-utils:1.0.0 (*)
-     |    |    |    \--- com.google.android.gms:play-services-basement:17.0.0 -> 17.1.1 (*)
-     |    |    \--- com.google.android.gms:play-services-tasks:17.0.0 (*)
-     |    \--- com.google.android.gms:play-services-stats:17.0.0 (*)
-     \--- androidx.room:room-runtime:2.2.5 -> 2.3.0 (*)
+\--- androidx.work:work-gcm:2.7.0
+     +--- androidx.work:work-runtime:2.7.0 (*)
+     +--- com.google.android.gms:play-services-gcm:17.0.0
+     |    +--- androidx.collection:collection:1.0.0 -> 1.1.0 (*)
+     |    +--- androidx.core:core:1.0.0 -> 1.7.0 (*)
+     |    +--- androidx.legacy:legacy-support-core-utils:1.0.0 (*)
+     |    +--- com.google.android.gms:play-services-base:17.0.0 -> 17.1.0
+     |    |    +--- androidx.collection:collection:1.0.0 -> 1.1.0 (*)
+     |    |    +--- androidx.core:core:1.0.0 -> 1.7.0 (*)
+     |    |    +--- androidx.fragment:fragment:1.0.0 -> 1.3.6 (*)
+     |    |    +--- com.google.android.gms:play-services-basement:17.0.0 -> 17.1.1
+     |    |    |    +--- androidx.collection:collection:1.0.0 -> 1.1.0 (*)
+     |    |    |    +--- androidx.core:core:1.0.0 -> 1.7.0 (*)
+     |    |    |    \--- androidx.fragment:fragment:1.0.0 -> 1.3.6 (*)
+     |    |    \--- com.google.android.gms:play-services-tasks:17.0.0
+     |    |         \--- com.google.android.gms:play-services-basement:17.0.0 -> 17.1.1 (*)
+     |    +--- com.google.android.gms:play-services-basement:17.0.0 -> 17.1.1 (*)
+     |    +--- com.google.android.gms:play-services-iid:17.0.0
+     |    |    +--- androidx.collection:collection:1.0.0 -> 1.1.0 (*)
+     |    |    +--- androidx.core:core:1.0.0 -> 1.7.0 (*)
+     |    |    +--- com.google.android.gms:play-services-base:17.0.0 -> 17.1.0 (*)
+     |    |    +--- com.google.android.gms:play-services-basement:17.0.0 -> 17.1.1 (*)
+     |    |    +--- com.google.android.gms:play-services-stats:17.0.0
+     |    |    |    +--- androidx.legacy:legacy-support-core-utils:1.0.0 (*)
+     |    |    |    \--- com.google.android.gms:play-services-basement:17.0.0 -> 17.1.1 (*)
+     |    |    \--- com.google.android.gms:play-services-tasks:17.0.0 (*)
+     |    \--- com.google.android.gms:play-services-stats:17.0.0 (*)
+     \--- androidx.room:room-runtime:2.2.5 -> 2.3.0 (*)

Please review and act accordingly

ashiagr added 7 commits March 10, 2022 16:58

Refactor: Format files

faa4288

Refactor: Remove unnecessary version check as SDK_INT is always >= VE…

38f57bb

…RSION_CODES.N

Add immutable pending intent flag to improve app's security as part o…

8176ba3

…f Android 12 migration changes

Upgrade androidxWorkVersion to 2.7.0

2a2f7f0

This version fixes a platform bug causing pending intent crash on targetSdkVersion 31. For more details, see: https://issuetracker.google.com/issues/194108978

Update disable WorkManager default initializer section in manifest af…

3441794

…ter upgrading to 2.7.0 For more details, see: https://developer.android.com/topic/libraries/architecture/workmanager/advanced/custom-configuration#remove-default

Update stories lib version

9eddee4

This commit updates immutable pending intent flag to stories lib > FrameSaveNotifier

ashiagr added the Android 12 label Mar 10, 2022

ashiagr added this to the Future milestone Mar 10, 2022

ashiagr self-assigned this Mar 10, 2022

ashiagr added the [Status] Not Ready for Merge label Mar 11, 2022

ashiagr mentioned this pull request Mar 11, 2022

Android 12: Security and privacy - Pending intents mutability (Stories) Automattic/stories-android#721

Merged

ashiagr requested review from malinajirka, mzorz, planarvoid, ravishanker and renanferrari March 11, 2022 07:51

Update stories lib version

3fe8f9b

ashiagr removed the [Status] Not Ready for Merge label Mar 11, 2022

ashiagr requested a review from develric March 11, 2022 10:18

malinajirka removed their request for review March 16, 2022 04:12

ashiagr requested review from zwarm and removed request for mzorz, planarvoid and renanferrari March 16, 2022 04:46

ravishanker approved these changes Mar 21, 2022

View reviewed changes

Merge branch 'trunk' into issue/16065-pending-intent-mutability

8c6741b

# Conflicts: # build.gradle

Fix merge

4e6407b

Revert androidxWorkVersion

ashiagr merged commit 681aa43 into trunk Mar 22, 2022

ashiagr deleted the issue/16065-pending-intent-mutability branch March 22, 2022 05:03

ashiagr modified the milestones: Future, 19.6 Mar 22, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Android 12: Security and privacy - Pending intents mutability #16082

Android 12: Security and privacy - Pending intents mutability #16082

Uh oh!

ashiagr commented Mar 10, 2022 •

edited

Loading

Uh oh!

peril-wordpress-mobile bot commented Mar 10, 2022 •

edited

Loading

Uh oh!

peril-wordpress-mobile bot commented Mar 10, 2022 •

edited

Loading

Uh oh!

ravishanker left a comment

Uh oh!

ravishanker commented Mar 21, 2022 •

edited

Loading

Uh oh!

peril-wordpress-mobile bot commented Mar 22, 2022

Uh oh!

wpmobilebot commented Mar 22, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Android 12: Security and privacy - Pending intents mutability #16082

Android 12: Security and privacy - Pending intents mutability #16082

Uh oh!

Conversation

ashiagr commented Mar 10, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details:

To test:

Test.1 Comments

Test.2 Quick Start Reminders

Test.3 Post Published

Test.4 Adhoc Notification

Test.5 Stats Widgets

Merge Instructions

Regression Notes

Uh oh!

peril-wordpress-mobile bot commented Mar 10, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

peril-wordpress-mobile bot commented Mar 10, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ravishanker left a comment

Choose a reason for hiding this comment

Uh oh!

ravishanker commented Mar 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

peril-wordpress-mobile bot commented Mar 22, 2022

Uh oh!

wpmobilebot commented Mar 22, 2022

The PR caused the following dependency changes:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ashiagr commented Mar 10, 2022 •

edited

Loading

peril-wordpress-mobile bot commented Mar 10, 2022 •

edited

Loading

peril-wordpress-mobile bot commented Mar 10, 2022 •

edited

Loading

ravishanker commented Mar 21, 2022 •

edited

Loading