opencabstandard / opencab

A standard for communication between in-cab trucking apps.
https://opencabstandard.org
MIT License
1 stars 3 forks source link

Android Bundle attempts to unparcel all values even if they are not requested #22

Open pnc opened 1 year ago

pnc commented 1 year ago

In versions of Android API 30 (11) and earlier, the system BaseBundle implementation eagerly reads and de-parcels all keys.

This means that, unlike with (say) a plain HashMap, parceled classes stored in keys that are not accessed may still be unparceled by the system when any key is accessed, leading to a crash if the parceled object refers to classes that are not available in the calling app.

This happens in this function: https://android.googlesource.com/platform/frameworks/base/+/refs/heads/android10-release/core/java/android/os/BaseBundle.java#292

This happens here on 12 and newer, which behaves differently and does not throw a ClassNotFoundException: https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/os/Parcel.java#5437

Combined with the Parcel issues discussed in https://github.com/opencabstandard/opencab/pull/21/commits/8f802cef4061e78986c1e40c1aa110d56f4bdd49, this is a further signal that Parcel is totally unsuitable as a serialization format. We'll want to use nested Bundles consisting only of native (int, string, long, etc.) types that are guaranteed to be available across all supported Android versions.