Java Code Examples for android.os.Bundle.clear()

/**
 * Scrubs Bundles for private serializable subclasses in the extras. If the Bundle's extras contain a
 * private serializable subclass, the Bundle is cleared. If the Bundle is null, has no extras, or the
 * extras do not contain a private serializable subclass, the Bundle is not mutated.
 *
 * @param bundle {@code Bundle} to scrub. This parameter may be mutated if scrubbing is necessary. This
 *               parameter may be null.
 * @return true if the Bundle was scrubbed, false if the Bundle was not modified.
 */
public static boolean isSuspicious(@Nullable final Bundle bundle) {

    if (bundle != null) {

    /*
     * Note: This is a hack to work around a private serializable classloader attack
     */
        try {
            // if a private serializable exists, this will throw an exception
            bundle.containsKey(null);
        } catch (final Exception e) {
            bundle.clear();
            return true;
        }
    }

    return false;
}
 

public static boolean scrub(final Bundle bundle) {
    if (null == bundle) {
        return false;
    }
    try {
        // if a private serializable exists, this will throw an exception
        bundle.containsKey(null);
    } catch (final Exception e) {
        bundle.clear();
        return true;
    }

    return false;
}
 

private void clearBundle(Bundle safeBundle) {
    safeBundle.clear();
    safeBundle = null;
}
 

@Override
protected void onSaveInstanceState(Bundle outState) {
    outState.clear();
}
 

@Override
protected void onSaveInstanceState(Bundle outState) {
    outState.clear();
}