Solve SecurityException: Permission Denial: starting Intent. What permission do I need?

Question

I want to open the play store from app. It's fine in Samsung, but it failed in OnePlus mobile. I don't know where does the alibaba come from. It's strange.

Exception java.lang.SecurityException: Permission Denial: starting Intent { act=android.intent.action.VIEW dat=http://play.google.com/... cmp=com.alibaba.intl.android.apps.poseidon/com.alibaba.android.intl.weex.activity.WeexPageActivity } from ProcessRecord{a1dd30c 15827:a2bliving.ie.a2b/u0a151} (pid=15827, uid=10151) not exported from uid 10156

Code:

private static final String PLAY_STORE_LINK = "http://play.google.com/store/apps/details?id=%s&hl=en";

public void openUpdateLink() {
        context.startActivity(new Intent(Intent.ACTION_VIEW, Uri.parse(getExternalAppLink())));
    }

 public String getExternalAppLink() {
        return String.format(PLAY_STORE_LINK, context.getPackageName());
    }

Answer 1

You need to set android:exported="true" in your AndroidManifest.xml file

<activity
    android:name="com.anurag.example.MainActivity"
    android:label="Demo" 
    android:exported="true">
    <intent-filter>
        <action android:name="android.intent.action.MAIN" >
        </action>
    </intent-filter>
</activity>

Answer 2

On that device, that Intent is getting modified to add a specific component (com.alibaba.intl.android.apps.poseidon/com.alibaba.android.intl.weex.activity.WeexPageActivity). I do not know if that is from the system chooser or something else. And, the activity that it resolves to is not exported.

So, mostly, this is a bug in that device.

However, since the activity is not exported, there is nothing you can do to start that specific activity.

Answer 3

This is not a bug in your app, but a bug in the Alibaba app. What happened was that they declared their activity WeexPageActivity to handle http/https/file schemes, but also made it not exported. So, every time your app tries to start an intent with one of these schemes and the Alibaba app is chosen or worse it's set as default YOUR app will crash.

For instance, if you use AdMob this will happen every time a user clicks on an ad (for me the latest culprit app is mxtech.videoplayer.ActivityWebBrowser).

Honestly, I don't know why Android doesn't ignore said activities instead of crashing or why the other developers would make said mistake, but it is not your fault.