The checks a browser activity repeats on a shared file it receives.
The launcher forwards a file only after its own checks, but TabBrowserActivity is exported, so any app can start a browser directly with any intent: nothing is trusted because "it came from the
launcher". Plain Java, no android.*; the glue reads the fields from the Intent.
A share is accepted only if ALL hold:
-
the action is exactly
android.intent.action.SEND;
-
the ClipData has exactly ONE item (the system checks the grant for every ClipData item, never for
EXTRA_STREAM, so the one URI is read from item 0 only);
-
the intent has no
data;
-
the intent's own flags carry
READ_FLAG (a read grant that really arrived with this intent; without it the system did not check that the sender holds access);
-
SharedContentPolicy#isAcceptableUri accepts the text (a content: URI of another app);
-
the authority is not a provider of this app (any of our providers, not only the file provider), judged by
isOwnProviderAuthority; if that check throws, the share is refused.