title: Why does Google say my code still has an Intent Vulnerability?
body: <p>My apps on the Google Play store are affected by the Intent Redirection Vulnerability (see article <a href="https://support.google.com/faqs/answer/9267555" rel="nofollow noreferrer">https://support.google.com/faqs/answer/9267555</a>) </p>
  
  <p>I implemented "Option 2" on the recommended solutions yet the warning is still being reported.</p>
  
  <p>I've tried several different ways of verifying the calling activity, but nothing passes whatever check they're doing.</p>
  
  <p>Here's their recommended solution:</p>
  
  <pre class="lang-java prettyprint-override"><code> // check if the originating Activity is from trusted package
   if (getCallingActivity().getPackageName().equals(“known”)) {
     Intent intent = getIntent();
     // extract the nested Intent
     Intent forward = (Intent) intent.getParcelableExtra(“key”);
     // redirect the nested Intent
     startActivity(forward);
   }
  </code></pre>
  
  <p>And here's my code:</p>
  
  <pre><code>public void onFinish() {
        finish();
        // check if the originating Activity is from trusted package
        if (getCallingActivity() != null &amp;&amp;
            getCallingActivity().getPackageName().equals(
             PerfectCommon.getAppContext().getPackageName())) {
          Intent intent = null;
          // extract the nested Intent
          intent =
             getIntent().getParcelableExtra(BaseActivity.ORIG_ACTIVITY);
          if (intent != null){
              // redirect the nested Intent
              startActivity(intent);
              return;
          }
        }
  
        Intent newIntent;
          SplashActivity context = SplashActivity.this;
          boolean portrait = PerfectCommon.portraitMode;
          ArrayList&lt;Intent&gt; intents = new ArrayList&lt;&gt;();
  
          // Create intent stack for next activities to run, starting w/ last
          newIntent = new Intent(context, portrait ? MainActivity.P.class : MainActivity.class);
          newIntent.setData(getIntent().getData());
          intents.add(newIntent);
  
          startActivities(intents.toArray(new Intent[intents.size()]));
      }
  
    };
  </code></pre>
  
  <p>The code should check to see if the calling activity is a trusted source, then use the intent; if it isn't then a different intent is used.</p>
  
  <p>However, when I publish the app on the Google Play store it says that the vulnerability still exists in this bit of code.</p>
  
  <p>This is legacy code and has been working fine up to now, so I prefer not to make large change to get past this, rather just need to pass whatever static checker is being used.</p>