Using Zxing Barcode scanner causes SecurityException

Question

I use Zxing Barcode Scanner in my app via launching an Intent so that I can scan a barcode and get the data back to my app. Very basic stuff; it has worked for a long time no problem. I recently got an error report through Play with the following stack trace:

    java.lang.SecurityException: Permission Denial: starting Intent 
{ act=com.google.zxing.client.android.SCAN cmp=com.ups.mobile.android/com.google.zxing.client.android.CaptureActivity } 
from ProcessRecord{421bafc8 11687:edu.byu.dburner.lendablefree/10141} 
(pid=11687, uid=10141) not exported from uid 10137
    at android.os.Parcel.readException(Parcel.java:1327)
    at android.os.Parcel.readException(Parcel.java:1281)
    at android.app.ActivityManagerProxy.startActivity(ActivityManagerNative.java:1736)
    at android.app.Instrumentation.execStartActivity(Instrumentation.java:1383)
    at android.app.Activity.startActivityForResult(Activity.java:3281)
    at edu.byu.dburner.lendable.xxxxx.xxxx$2.onClick(xxxxxx.java:539)
    at android.view.View.performClick(View.java:3644)
    at android.view.View$PerformClick.run(View.java:14313)
    at android.os.Handler.handleCallback(Handler.java:605)
    at android.os.Handler.dispatchMessage(Handler.java:92)
    at android.os.Looper.loop(Looper.java:137)
    at android.app.ActivityThread.main(ActivityThread.java:4514)
    at java.lang.reflect.Method.invokeNative(Native Method)
    at java.lang.reflect.Method.invoke(Method.java:511)
    at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:993)
    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:760)
    at dalvik.system.NativeStart.main(Native Method)

As far as I can tell with the stack trace, there is some issue with com.ups.mobile.android, which is the UPS app that also utilizes the Zxing app. I tried installing the UPS app and mine on the same phone and triggering the onClick event where the problem occurred. Nothing significant occurs, except a chooser asking me to pick the Barcode Scanning app or the UPS app to perform the Intent. My only guess would be that both of our apps are having some sort of collision where only one person can use the Barcode Scanner package at a time, resulting in a SecurityException. But that doesn't make much sense to me since I can do it no problem, and I imagine many people have multiple apps that use Zxing installed with no issue.

Does anyone have an insights into what causes this error and what I can do to fix it?

EDIT: Per SeanOwen's comment, if you have this trouble with Barcode Scanner specifically, really do use IntentIntegrator. They provide a built-in method setTargetApplications. You can use this to make the Intent only use the actual Barcode Scanner app: setTargetApplications(IntentIntegrator.TARGET_BARCODE_SCANNER_ONLY); Easy as pie.

Answer 1

UPS Mobile is not linking to the Barcode Scanner app, but apparently have baked in its source code. This is not terribly shocking, even if it is unsupported and not recommended by the ZXing team.

However, the UPS Mobile developers then did two things:

1. They kept the same <intent-filter>, particularly where they are advertising that they are handling the com.google.zxing.client.android.SCAN action, despite the fact that they are not actually that app

2. They marked the activity as not exported

Courtesy of this bug, the chooser will still show their activity, despite the fact that theirs is not exported and therefore cannot be launched.

UPS Mobile either should be linking to Barcode Scanner the way you are, or not advertising this action. And, of course, this bug should get fixed.

Unfortunately, the only workaround I can think of would be for you to add in your Intent the actual package name for Barcode Scanner (com.google.zxing.client.android) to try to limit it to that app only.

This is reminiscent of another SO question, that led to a blog post of mine, that obviously was insufficient to educate UPS, so I'll probably blog on this again...