Android Security Considerations

Other applications on the device reach a Qt for Android application through intents, activity results, and the clipboard. Qt passes the data from these channels to your application unchanged, but it does not check whether the data is safe to use. This page describes what each channel exposes and what your application must check.

Qt for Android treats the Android system as trusted and every other application as untrusted, so everything arriving on these channels is untrusted data. For how this fits into the wider division of responsibility, see the Qt Shared Security Model. For the tools that build your application, see Using Qt's Developer Tools Securely.

Incoming intents

Qt handles intents whose action is ACTION_VIEW. It takes the intent's data URI and passes it to QDesktopServices::openUrl(), which dispatches to the handler you registered with QDesktopServices::setUrlHandler(). Qt does not validate that URI, because only your application knows which schemes, hosts, and paths are meaningful to it.

If you declare a matching intent filter, any application on the device can start your activity with any URI it chooses. A web page can also start your activity through a link. Validate the scheme, the host, and the path before you use them. Never treat a path from a URI as a trusted file system location.

Activity results

When you start another activity for a result, Qt passes the returned intent to your result callback unchanged. Qt does not inspect it. The activity that produced the result might not be the one you expected, because any application can register for the same action.

Check the request code, check the result code, and validate the intent's contents before using them.

Clipboard content

QClipboard on Android reads the system clipboard, which any application can write. A QMimeData obtained from it can carry any format and any payload those applications chose to put there.

Treat clipboard content like a downloaded file. Validate it before you render it as markup, pass it to a shell, or build a file path from it.

Recommendations

• Validate at the entry point. Validate data in the URL handler, in the activity result receiver, and where you read the clipboard. Deeper in the application, the origin of the data is no longer clear.
• Declare only the intent filters you need. Every filter widens the set of applications that can reach you, and an exported activity is reachable by any application on the device.
• Prefer allowlists. Accept the schemes, hosts, and MIME types you support and reject everything else. Do not try to list all dangerous values.
• Do not infer trust from the channel. A URI from an intent does not show who sent it.