Android Broadcast Security

问题:

In android, you can set the action of a broadcast to almost anything (save system actions.) My question is how can you prevent other apps from spoofing your broadcasts? Say you have an action called "com.a.b.c". Other applications should receive com.a.b.c, but they shouldn't be able to send com.a.b.c. How can that be done?

Also, I seek clarification of permissions that deal with broadcast reception. I find the Android documentation a bit confusing with this. Is there a way to make a permission that other applications have to have to receive com.a.b.c? Like specifying com.a.b.cpermission in the manifest for others to use.

回答1:

You can use LocalBroadcastManager https://developer.android.com/reference/android/support/v4/content/LocalBroadcastManager.html

Also you can define permission in the manifest. And use http://developer.android.com/reference/android/content/Context.html#sendBroadcast%28android.content.Intent,%20java.lang.String%29 to send broadcast, then only apps which requested your "com.a.b.c" permission will receive. But this is public api to your app, be careful this way.