Skip to content

Harden grade reminder notification PendingIntent by using explicit activity intent - #209

Closed
alvin000009238 with Copilot wants to merge 2 commits into
mainfrom
copilot/fix-code-scanning-alerts
Closed

Harden grade reminder notification PendingIntent by using explicit activity intent#209
alvin000009238 with Copilot wants to merge 2 commits into
mainfrom
copilot/fix-code-scanning-alerts

Conversation

Copilot AI commented Aug 7, 2026

Copy link
Copy Markdown

This PR addresses the code scanning finding for implicit PendingIntent usage in the Android reminder notification flow. The notification tap action now uses an explicit app activity target to remove intent hijacking risk.

  • Security fix (alert Refactor Turnstile integration to popup verify with robust init and error reporting #12)

    • Updated GradeReminderNotifier.openAppIntent() to always construct an explicit Intent(appContext, MainActivity::class.java) before creating the PendingIntent.
    • Preserved existing launch behavior via FLAG_ACTIVITY_NEW_TASK | FLAG_ACTIVITY_CLEAR_TOP.
    • Kept immutable pending intent semantics unchanged.
  • Impact scope

    • Single-file, localized change in:
      • android/app/src/main/java/com/clhs/score/reminders/GradeReminderNotifier.kt
    • No flow or UX redesign; only intent construction was tightened.
val intent = Intent(appContext, MainActivity::class.java).apply {
    flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP
}
return PendingIntent.getActivity(
    appContext,
    nextRequestCode(),
    intent,
    PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
)

Copilot AI lite review requested due to automatic review settings August 7, 2026 09:40

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.

Co-authored-by: alvin000009238 <107313913+alvin000009238@users.noreply.github.com>
Copilot AI review requested due to automatic review settings August 7, 2026 09:41

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot AI changed the title [WIP] Fix code scanning alert #12 Harden grade reminder notification PendingIntent by using explicit activity intent Aug 7, 2026
Copilot AI requested a review from alvin000009238 August 7, 2026 09:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants