diff --git a/CHANGELOG.md b/CHANGELOG.md index 5a9bc73e6..82913b7d8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,13 @@ Android ChangeLog [Migration Guides](https://github.com/urbanairship/android-library/tree/master/documentation/migration) +Version 9.7.1 - March 14, 2019 +============================== + +Fixed a security issue within Urban Airship SDK, that could allow trusted URL redirects in certain +edge cases. All applications that are using Urban Airship SDK 9.0.0 - 9.7.0 should update as soon as +possible. For more details, please email security@urbanairship.com. + Version 9.7.0 - January 22, 2019 ================================ Minor release that allows listing for Urban Airship log messages. diff --git a/airship.properties b/airship.properties index 51b5c4f1e..abb59f22c 100644 --- a/airship.properties +++ b/airship.properties @@ -1,5 +1,5 @@ # Airship Version - major.minor.patch -version = 9.7.0 +version = 9.7.1 # Airship Version Qualifier beta, release, etc... #versionQualifier = beta diff --git a/urbanairship-core/src/main/AndroidManifest.xml b/urbanairship-core/src/main/AndroidManifest.xml index a98a39f0b..85132c421 100644 --- a/urbanairship-core/src/main/AndroidManifest.xml +++ b/urbanairship-core/src/main/AndroidManifest.xml @@ -11,23 +11,40 @@ - - - + - + + - - + - + + + + + - + @@ -35,7 +52,8 @@ + android:theme="@style/UrbanAirship.RateAppActivity" + android:exported="false"> + android:theme="@style/UrbanAirship.LandingPageActivity" + android:exported="false" > - - + - - diff --git a/urbanairship-core/src/main/java/com/urbanairship/actions/RateAppAction.java b/urbanairship-core/src/main/java/com/urbanairship/actions/RateAppAction.java index 8537a8b78..c7ad9d1fa 100644 --- a/urbanairship-core/src/main/java/com/urbanairship/actions/RateAppAction.java +++ b/urbanairship-core/src/main/java/com/urbanairship/actions/RateAppAction.java @@ -71,9 +71,9 @@ public class RateAppAction extends Action { private static final String MARKET_PLAY_URL = "market://details?id="; /** - * HTTP URL to the Google Play store. Used instead of the market URl if the play store is not available. + * HTTPS URL to the Google Play store. Used instead of the market URl if the play store is not available. */ - private static final String HTTP_PLAY_URL = "http://play.google.com/store/apps/details?id="; + private static final String HTTPS_PLAY_URL = "https://play.google.com/store/apps/details?id="; /** * URL to the Amazon store. @@ -172,7 +172,7 @@ private Uri getAppStoreUri() { if (PlayServicesUtils.isGooglePlayStoreAvailable(UAirship.getApplicationContext())) { return Uri.parse(MARKET_PLAY_URL + packageName); } else { - return Uri.parse(HTTP_PLAY_URL + packageName); + return Uri.parse(HTTPS_PLAY_URL + packageName); } } diff --git a/urbanairship-core/src/main/java/com/urbanairship/analytics/Event.java b/urbanairship-core/src/main/java/com/urbanairship/analytics/Event.java index a33ca37f5..685c37b8f 100644 --- a/urbanairship-core/src/main/java/com/urbanairship/analytics/Event.java +++ b/urbanairship-core/src/main/java/com/urbanairship/analytics/Event.java @@ -9,6 +9,7 @@ import android.support.annotation.RestrictTo; import android.telephony.TelephonyManager; +import com.urbanairship.Logger; import com.urbanairship.UAirship; import com.urbanairship.json.JsonMap; import com.urbanairship.push.PushManager; @@ -50,7 +51,7 @@ public abstract class Event { static final String PACKAGE_VERSION_KEY = "package_version"; static final String LAST_METADATA_KEY = "last_metadata"; - @IntDef({LOW_PRIORITY, NORMAL_PRIORITY, HIGH_PRIORITY}) + @IntDef({ LOW_PRIORITY, NORMAL_PRIORITY, HIGH_PRIORITY }) @Retention(RetentionPolicy.SOURCE) public @interface Priority {} @@ -69,7 +70,6 @@ public abstract class Event { */ public static final int HIGH_PRIORITY = 2; - /** * Constructor for Event. * @@ -118,14 +118,14 @@ public String createEventPayload(String sessionId) { // Copy the event data and add the session id data = JsonMap.newBuilder() - .putAll(data) - .put(SESSION_ID_KEY, sessionId) - .build(); + .putAll(data) + .put(SESSION_ID_KEY, sessionId) + .build(); object.put(TYPE_KEY, getType()) - .put(EVENT_ID_KEY, eventId) - .put(TIME_KEY, time) - .put(DATA_KEY, data); + .put(EVENT_ID_KEY, eventId) + .put(TIME_KEY, time) + .put(DATA_KEY, data); return object.build().toString(); } @@ -214,18 +214,23 @@ public String getConnectionType() { * @return The connection subtype as a String. */ public String getConnectionSubType() { - - //determine network connectivity state - //each of these may return null if there is no connectivity, and this may change at any moment - //keep a reference, then do a null check before accessing - ConnectivityManager cm = (ConnectivityManager) UAirship.getApplicationContext().getSystemService(Context.CONNECTIVITY_SERVICE); - if (cm != null) { - NetworkInfo ni = cm.getActiveNetworkInfo(); - if (ni != null) { - return ni.getSubtypeName(); + try { + //determine network connectivity state + //each of these may return null if there is no connectivity, and this may change at any moment + //keep a reference, then do a null check before accessing + ConnectivityManager cm = (ConnectivityManager) UAirship.getApplicationContext().getSystemService(Context.CONNECTIVITY_SERVICE); + if (cm != null) { + NetworkInfo ni = cm.getActiveNetworkInfo(); + if (ni != null) { + return ni.getSubtypeName(); + } } + return ""; + } catch (ClassCastException e) { + // https://github.com/urbanairship/android-library/issues/115 + Logger.error("Connection subtype lookup failed", e); + return ""; } - return ""; } /** @@ -266,11 +271,10 @@ public boolean isValid() { return true; } - /** * Helper method to convert milliseconds to a seconds string containing a double. - * @param milliseconds Milliseconds to convert. * + * @param milliseconds Milliseconds to convert. * @return Seconds as a string containing a double. * @hide */ @@ -281,10 +285,12 @@ public static String millisecondsToSecondsString(long milliseconds) { /** * The event's send priority. + * * @return The event's send priority. */ @Priority public int getPriority() { return NORMAL_PRIORITY; } + }