Upgrade to Pro — share decks privately, control downloads, hide ads and more …

メルカリとソウゾウアプリの アプリ間連携の仕組み in 2017 summer

operandoOS
August 25, 2017

メルカリとソウゾウアプリの アプリ間連携の仕組み in 2017 summer

メルカリとソウゾウアプリの
アプリ間連携の仕組み
in 2017 summer

Souzoh Android Talk
https://mercari.connpass.com/event/63552/

Application Interoperability Sample
https://github.com/operando/Application-Interoperability-Sample

Android アプリのセキュア設計・セキュアコーディングガイド
https://www.jssec.org/dl/android_securecoding.pdf

「メルカリとソウゾウアプリのアプリ間連携の仕組み in 2017 summer」のセキュアコーディングガイドに関する補足
http://hack-it-iron.hatenablog.com/entry/2017/08/28/101615

operandoOS

August 25, 2017
Tweet

More Decks by operandoOS

Other Decks in Technology

Transcript

  1. <?xml version="1.0" encoding="utf-8"?> <manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.os.operando.application.interoperability.sample" android:sharedUserId="app.shareduserid"> .... </manifest> <?xml

    version="1.0" encoding="utf-8"?> <manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.example.shareduserid_app" android:sharedUserId="app.shareduserid"> .... </manifest> AndroidManifest.xml
  2. sharedUserId // AΞϓϦ(com.os.operando.application.interoperability.sample) getSharedPreferences("master_app", MODE_PRIVATE).edit().putInt("int", 1).apply(); // BΞϓϦ(com.example.shareduserid_app) // ஋͕औಘͰ͖Δ

    try { Context c = createPackageContext(“com.os.operando.application.interoperability.sample", CONTEXT_RESTRICTED); int i = c.getSharedPreferences(“master_app”, MODE_PRIVATE).getInt("int", 0); Log.d(TAG, i + ""); // 1 } catch (PackageManager.NameNotFoundException e) { e.printStackTrace(); }
  3. Android Component + Permission • Androidͷίϯϙʔωϯτʹ͸PermissionΛࢦఆͰ͖Δ • ίϯϙʔωϯτΛར༻͢ΔΞϓϦʹPermissionͷఆٛΛཁٻͰ͖Δ • ίϯϙʔωϯτͷఏڙଆ͕ΞϓϦಠࣗͷSignature

    PermissionΛ
 ఆٛ͢Δ • ίϯϙʔωϯτͷఏڙଆ͸ٻΊΔPermission͕ར༻ଆʹ
 ఆٛ͞Ε͍ͯͳ͚Ε͹ίϯϙʔωϯτͷ࢖༻ΛෆՄೳʹͰ͖Δ
  4. ContentProvider + Permission • ContentProvider΋ίϯϙʔωϯτͳͷͰPermission͕ࢦఆͰ͖Δ • readPermissionଐੑͱwritePermissionଐੑ͕ଘࡏ͢Δ • ಡΈॻ͖ͲͪΒͱ΋ಉ͡Permissionͷ͍ͨ͠৔߹͸permissionଐੑΛ࢖͏ •

    permissionଐੑʹΞϓϦಠࣗͷSignature PermissionΛࢦఆ͢Ε͹
 ಉ͡ॺ໊Λ࣋ͭΞϓϦͰ͔͠ಡΈग़ͤͳ͍ContentProvider͕࡞ΕΔ • ଞͷίϯϙʔωϯτ(ActivityͳͲ)΋ಉ༷ͷखॱͰಉ͜͡ͱ͕Ͱ͖Δ
  5. ͕͔ͩ͠͠ • Signature PermissionʹҰ෦ ࠔͬͨ໰୊͕ଘࡏ͢Δ • Android 5.0ະຬͩͱɺPermission ఆٛઌউͪ໰୊͕͋Δ •

    ͔֬5.0ະຬͩͬͨؾ͕͢Δ͚Ͳιʔε͕ݟ͔ͭΒͳ͔ͬͨͷͰόʔδϣϯ
 ҙࣝ͠ͳ͍΄͏͕͍͍ • protectionLevel͕signatureͷPermissionΛఆٛ͢ΔલʹɺprotectionLevel͕ ऑ͍(normalͱ͔)ಉ໊ͷPermission͕ఆٛ͞Εͯ͠·͏ͱɺಉ͡ॺ໊Λ࣋ͨͳ͍ ΞϓϦ͔ΒͰ΋ίϯϙʔωϯτ͕ݺͼग़ͤΔ • ୺຤಺ʹطʹಉ໊ͷpermissionͷఆ͕ٛ͋Δ৔߹ɺޙ͔Βఆٛ͞ΕΔ৘ใ͕
 ্ॻ͖͞Εͳ͍໰୊͕͋Δ
  6. ಠࣗఆٛ Signature PermissionΛճආ Ͱ͖ΔAndroid OSͷಛੑͱͦͷରࡦ • ৄࡉ͸ηΩϡΞίʔσΟϯάΨΠυͷ ʮ5.2.3.1. ಠࣗఆٛ Signature

    PermissionΛճ ආͰ͖ΔAndroid OSͷಛੑͱͦͷରࡦʯΛࢀর • https://www.jssec.org/report/ securecoding.html • ରࡦ΋ͪΌΜͱಡΜͰͶʂ
  7. ໌ࣔతIntentͰ࿈ܞ ػೳఏڙଆ <!-- ػೳఏڙଆ --> <activity android:name=".SettingActivity" android:label="@string/title_activity_setting" android:theme="@style/AppTheme.NoActionBar" />

    <activity-alias android:name="com.os.operando.application.interoperability.sample.S ettingAliasActivity" android:exported="true" android:permission="master.app.OPEN" android:targetActivity=".SettingActivity" />
  8. ໌ࣔతIntentͰ࿈ܞ ར༻ଆ // ར༻ଆ Intent i = new Intent(); i.setComponent(new

    ComponentName("com.os.operando.sample", “com.os.operando.sample.SettingAliasActivity")); startActivity(i);
  9. ҉໧తIntent??Ͱ࿈ܞ • URI = Deep LinkͰػೳΛݺͼग़͢ • Intent#setPackageϝιουͰ໌ࣔతʹͲͷΞϓϦʹରͯ͠ͷ Intentͳͷ͔Λࢦఆ͢Δ •

    ಉ͡Intent FilterΛఆٛͨ͠ΞϓϦ͕͋ͬͯ΋ϑοΫ͞Εͳ͍ • https://developer.android.com/reference/android/content/ Intent.html#setPackage(java.lang.String)
  10. ҉໧తIntent??Ͱ࿈ܞ ػೳఏڙଆ <activity android:name=".SampleActivity"> <intent-filter> <data android:host="sample" android:scheme="https" /> <action

    android:name="android.intent.action.VIEW" /> <category android:name="android.intent.category.DEFAULT" /> <category android:name="android.intent.category.BROWSABLE" /> </intent-filter> </activity>
  11. • ࿈ܞઌ͕ࣗࣾΞϓϦ + ಉҰॺ໊ͷΞϓϦΛର৅ͱͯ͠Δ͜ͱ͕લఏͷ৔߹ • ࿈ܞઌͷΞϓϦͷॺ໊͕ࣗࣾͷॺ໊͔Ͳ͏͔Λௐ΂Δ • PackageManager#getPackageInfoͷflagʹ PackageManager.GET_SIGNATURESΛࢦఆ͢Δͱॺ໊ͷ৘ใ͕खʹೖΔ •

    ΞϓϦ͕Πϯετʔϧ͞Ε͍ͯΔ͔Ͳ͏͔΋߹Θͤͯௐ΂Δ͜ͱ͕Ͱ͖Δ • https://developer.android.com/reference/android/content/pm/ PackageManager.html#getPackageInfo(java.lang.String, int) ࿈ܞઌͷͷΞϓϦ͕ຊ෺͔Ͳ͏͔Λௐ΂Δ