I have a BroadcastReceiver statically registered in my Android app that processes incoming SMS messages, for example:
<receiver android:name=".receivers.SmsReceiver" android:exported="true" > <intent-filter android:priority="100" > <action android:name="android.provider.Telephony.SMS_RECEIVED" /> </intent-filter> </receiver>
Lint notes this with a warning, which causes the recipient to be exported without any permissions from the caller. If I set the exported property to false, the system will not be able to call my recipient after receiving an SMS message.
So, what permission should I require from the System when registering my receiver for processing incoming SMS messages?
Edit:
I do not ask for the "uses-permission" tag, which allows my application to receive SMS messages. I am asking for the correct "android: permission" value for my receiver, so only the system can send broadcast messages like this, and the other application cannot replace such an event for my application.
eg:.
<receiver android:name=".receivers.SmsReceiver" android:exported="true" android:permission="com.android.permission.SOME_PERMISSION_ONLY_THE_SYSTEM_HAS"> <intent-filter android:priority="100" > <action android:name="android.provider.Telephony.SMS_RECEIVED" /> </intent-filter> </receiver>
source share