Validate deep-link args when resolving the start location

[mbarta]

Problem

NavigatorHost.ensureDeeplinkStartLocationValid() validates the start location only inside the deepLinkExtras intent extra (android-support-nav:controller:deepLinkExtras).

AndroidX NavController also reads a second extra — deepLinkArgs (android-support-nav:controller:deepLinkArgs) — and merges it over deepLinkExtras when assembling each destination's arguments (arguments.putAll(globalArgs) followed by arguments.putAll(deepLinkArgs[index]), so the later write wins). Because an exported Activity's launch intent is externally controllable, a location (or any other argument) supplied via deepLinkArgs overrides the validated value and becomes the navigator's start destination — loading an unvalidated URL into the host's WebView.

Fix

These android-support-nav:controller:* extras are only ever produced by NavDeepLinkBuilder from within the app, so the fix verifies the launching intent's origin before honoring them — the same direction AndroidX is taking upstream (see aosp/4111813 — "Verify intent origin before handling explicit deep links").

ensureDeeplinkStartLocationValid() now:

• Trusts intents the app produced itself and leaves them untouched. An intent is trusted when its calling package (or referrer authority) is this app's package; intents carrying the attacker-settable EXTRA_REFERRER / EXTRA_REFERRER_NAME are never trusted.
• Sanitizes every other intent (rather than dropping it): each deepLinkArgs per-destination bundle is emptied so it can't override the validated start location, and a deepLinkExtras start location whose host doesn't match the configured start host is reverted to the configured start location.

This keeps legitimate same-host start locations working while preventing an external intent from steering the navigator to an arbitrary URL, and it no longer scrubs deep links the app created itself.

Tests

NavigatorHostTest covers:

• a trusted, self-originated intent is left untouched;
• an untrusted intent with an off-host start location is reverted to the configured one;
• an untrusted intent with a same-host start location is preserved;
• an untrusted intent's deepLinkArgs are emptied;
• a spoofed-referrer intent is treated as untrusted.

🤖 Generated with Claude Code