[FabianDevel]

Motivation

An external webpage or app could craft a browsable or external intent: launching NewMessageActivity with arrivedFromExistingDraft=true and a malicious draftResource (such as @attacker.example/capture). When fetchDraft() was invoked, raw URL concatenation in ApiRoutes.resource() caused OkHttp to resolve the effective host to the attacker endpoint while attaching the user's Authorization: Bearer token.

Changes

• Exported Trampoline Isolation: Made NewMessageActivity non-exported (android:exported="false"), preventing external apps and browsers from directly targeting it or injecting internal navigation extras. Moved external compose intent filters (VIEW/SENDTO for mailto:, SEND/SEND_MULTIPLE) to a dedicated exported ExternalComposeActivity trampoline that forwards only safe, allowlisted compose data (EXTRA_EMAIL, EXTRA_SUBJECT, EXTRA_TEXT, EXTRA_STREAM, etc.).
• ViewModel Defense: In NewMessageViewModel.fetchDraft(), validate that draftResource is a relative path starting with / before querying the repository.
• Origin Validation: In ApiRoutes.resource() and rescheduleDraft(), enforce relative paths starting with / (disallowing // and /\\) and verify that the resolved URL matches the Infomaniak Mail API host, scheme, and has no userinfo.
• Unit Tests: Added ApiRoutesTest covering valid relative paths, userinfo injection attempts, scheme-relative URLs, and absolute URLs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Exported activity callers can bypass action-based external-intent detection using an arbitrary or null action.

Review effort: Balanced
Findings: 2 · 1

Open (3)

• Exported activity trusts attacker-controlled intent routing · New
• Untrusted intent fields bypass external caller classification · New
• Kotlin line exceeds the 130-character limit · New

What changed in this PR

Hardens compose-intent handling and API resource URL construction against credential leakage.

Changes:

• Sanitizes external compose intents and forces new-message mode.
• Validates API resource URLs against the Mail API origin.
• Adds malicious URL regression tests.

File	Description
ApiRoutes.kt	Validates resource URLs and draft scheduling routes.
NewMessageActivity.kt	Removes internal extras from recognized external intents.
NewMessageViewModel.kt	Adds intent and draft-resource safeguards.
ApiRoutesTest.kt	Tests accepted and rejected resource paths.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

The security-critical trampoline lacks regression coverage for its allowlist and URI forwarding.

Review effort: Balanced
Findings: 1

Open (1)

• Add regression test for trampoline extra filtering and URI grant forwarding · New

Resolved since last review (3)

• Untrusted intent fields bypass external caller classification
• Exported activity trusts attacker-controlled intent routing
• Kotlin line exceeds the 130-character limit

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud