{"push_id":2963541014,"size":1,"distinct_size":1,"ref":"refs/heads/master","head":"c1d452d5d68374af2786d5efaa26e24f15758acd","before":"6f7a7acbae641599c032e24495b7282859234409","commits":[{"sha":"c1d452d5d68374af2786d5efaa26e24f15758acd","author":{"name":"Jan Girlich","email":"7f963be36a4d1684501f3e97b6e3cf83d5a3ac66@modzero.ch"},"message":"Only warn about singleTask/singleInstance usage when a API level less than 21 is supported\n\nThe underlying vulnerability is that with ActivityManager.getRecentTasks()\nany app with the permission GET_TASKS can read the Intents sent to create\nthe task. This would reveal the possibly sensitive contents of these Intents.\n\nAccording to the Android documentation at https://developer.android.com/reference/android/app/ActivityManager.html#getRecentTasks(int,%20int)\nstarting with API level 21 it is no longer possible to read all Intents sent\nto a root activity by using ActivityManager.getRecentTasks(). After API\nlevel 21, only Intents sent from your own app and other apps to be known\ninsensitive like the home/launcher app.\n\nSee also chapter 4.1.3.3 (page 94) in http://www.jssec.org/dl/android_securecoding_en.pdf","distinct":true,"url":"https://api.github.com/repos/vollkorn1982/Mobile-Security-Framework-MobSF/commits/c1d452d5d68374af2786d5efaa26e24f15758acd"}]}
{"actor":{"display_login":"vollkorn1982"}}