1.移除ACCESS_MOCK_LOCATION 权限

2.MMKV启用AES-256加密保存 3.修复导出组件和 Deep Links的处理建议 4.加入混淆代码 5.删除蓝牙透传RAW TCP（socket）
2026-07-14 11:08:43 +08:00
parent 4f77f25be4
commit a25e4a093d
22 changed files with 1000 additions and 173 deletions
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -43,9 +43,9 @@
    <uses-permission android:name="android.permission.READ_PHONE_STATE" /> <!-- 读取缓存数据 -->
    <!-- 蓝牙扫描权限 -->
    <uses-permission android:name="android.permission.BLUETOOTH_ADMIN" /> <!-- 获取模拟定位信息 -->
-<!--    <uses-permission-->
-<!--        android:name="android.permission.ACCESS_MOCK_LOCATION"-->
-<!--        tools:ignore="MockLocation,ProtectedPermissions" />-->
+    <!--    <uses-permission-->
+    <!--        android:name="android.permission.ACCESS_MOCK_LOCATION"-->
+    <!--        tools:ignore="MockLocation,ProtectedPermissions" />-->

    <permission
        android:name="android.permission.INTERACT_ACROSS_USERS_FULL"
@@ -96,6 +96,7 @@
    <application
        android:name=".MyApplication"
        android:allowBackup="false"
+        android:enableOnBackInvokedCallback="true"
        android:fullBackupContent="false"
        android:icon="@mipmap/logo_abbidot"
        android:label="@string/app_name"
@@ -106,7 +107,7 @@
        android:theme="@style/Theme.Tracker"
        android:usesCleartextTraffic="true"
        tools:replace="android:supportsRtl"
-        tools:targetApi="n">
+        tools:targetApi="33">
        <activity
            android:name=".ui.activity.account.cn.RegisterCNActivity"
            android:exported="false" />
@@ -430,33 +431,43 @@
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.set.AboutActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.account.recharge.cn.RechargeHistoryCNActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.account.recharge.cn.RechargeDeviceDetailCNActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.account.recharge.cn.RechargeAmountCNActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".deprecated.ui.activity.LoginRegisterCNActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.DebugActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.MyCropImageActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.WebViewActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.account.recharge.AddCreditCardActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".deprecated.ui.activity.profile.recharge.PaymentResultActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.account.recharge.PaymentMethodPayPalActivity"
@@ -478,15 +489,19 @@
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.account.recharge.PaymentMethodStripeActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.map.MapLiveActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.map.HomeMapNavigationActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.data.HistoryDataActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.device.set.LedLightActivity"
@@ -494,12 +509,15 @@
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.account.FencesAddActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.SwipeActionActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.DetailActivity"
+            android:exported="false"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ui.activity.SplashActivity"
@@ -560,6 +578,7 @@
        <service
            android:name="com.baidu.location.f"
            android:enabled="true"
+            android:exported="false"
            android:process=":remote" /> <!-- 谷歌地图 -->
        <meta-data
            android:name="com.google.android.geo.API_KEY"
@@ -577,6 +596,7 @@
        <activity
            android:name="com.hjq.logcat.LogcatActivity"
            android:configChanges="orientation|screenSize|keyboardHidden"
+            android:exported="false"
            android:launchMode="singleInstance"
            android:screenOrientation="portrait"
            android:theme="@style/Theme.AppCompat.Light.NoActionBar"
@@ -610,7 +630,12 @@
            android:value="${MAPBOX_ACCESS_TOKEN}" />
        <meta-data
            android:name="com.abbidot.metadata.http.request.key"
-            android:value="${HTTP_REQUEST_KEY}" /> <!-- **************************************Stripe支付start********************************************* -->
+            android:value="${HTTP_REQUEST_KEY}" />
+        <meta-data
+            android:name="com.abbidot.metadata.card.rsa.key"
+            android:value="${CARD_RSA_KEY}" />
+
+        <!-- **************************************Stripe支付start********************************************* -->
        <!-- <meta-data -->
        <!-- android:name="com.stripe.example.metadata.backend_url" -->
        <!-- android:value="${BACKEND_URL}" /> -->
--- a/app/src/main/java/com/abbidot/tracker/constant/KeyNames.kt
+++ b/app/src/main/java/com/abbidot/tracker/constant/KeyNames.kt
@@ -11,6 +11,7 @@ class KeyNames {
        const val BUG_LY_KEY_NAME = "$COMMON_PREFIX.bugly.key"
        const val MAPBOX_ACCESS_TOKEN = "$COMMON_PREFIX.mapbox.access.token"
        const val HTTP_REQUEST_KEY = "$COMMON_PREFIX.http.request.key"
+        const val CARD_RSA_KEY = "$COMMON_PREFIX.card.rsa.key"
        const val STRIPE_RELEASE_KEY = "$COMMON_PREFIX.stripe.release.key"
        const val STRIPE_TEST_KEY = "$COMMON_PREFIX.stripe.test.key"
    }
--- a/app/src/main/java/com/abbidot/tracker/ui/activity/SplashActivity.kt
+++ b/app/src/main/java/com/abbidot/tracker/ui/activity/SplashActivity.kt
@@ -79,6 +79,7 @@ class SplashActivity : QMUIActivity() {
        notificationManager.cancelAll()

        Utils.SECRET_KEY = Util.getMetadata(applicationContext, KeyNames.HTTP_REQUEST_KEY)
+        Utils.CARD_RSA_KEY = Util.getMetadata(applicationContext, KeyNames.CARD_RSA_KEY)
        INetworkService.apply {
            //国内外服务器切换域名
            BASE_URL = if (AppUtils.isDebug()) BASE_URL_TEST
--- a/app/src/main/java/com/abbidot/tracker/ui/activity/set/AboutActivity.kt
+++ b/app/src/main/java/com/abbidot/tracker/ui/activity/set/AboutActivity.kt
@@ -12,7 +12,7 @@ import com.qmuiteam.qmui.widget.grouplist.QMUICommonListItemView

 class AboutActivity : BaseActivity<ActivityAboutBinding>(ActivityAboutBinding::inflate) {

-    private val mWebsiteUrl = "www.abbidot.com"
+    private val mWebsiteUrl = "https://www.abbidot.com"

    override fun getTopBar() = mViewBinding.ilAboutTopBar.titleTopBar

--- a/app/src/main/java/com/abbidot/tracker/util/SocketUtilManageV2.kt
+++ b/app/src/main/java/com/abbidot/tracker/util/SocketUtilManageV2.kt
@@ -28,21 +28,21 @@ class SocketUtilManageV2 {

    @Synchronized
    fun initEasySocket(context: Context, mac: String, data: ByteArray) {
-        try {
-            val data1 = SRBleCmdUtil.instance.byteToInt(data[1])
-            val data2 = SRBleCmdUtil.instance.byteToInt(data[2])
-            val data3 = SRBleCmdUtil.instance.byteToInt(data[3])
-            val data4 = SRBleCmdUtil.instance.byteToInt(data[4])
-            val ip = "$data1.$data2.$data3.$data4"
-            val port = SRBleCmdUtil.instance.byte2ArrayToInt(data.sliceArray(5..6))
-            val socketAddress = "$ip:$port"
-            LogUtil.e(socketAddress)
-            mMac = mac
-            mNeedSendMessage = data.sliceArray(8..data.size - 2)
-            initEasySocket(context, ip, port)
-        } catch (e: Exception) {
-            LogUtil.e("initEasySocket 异常:${e.message}")
-        }
+//        try {
+//            val data1 = SRBleCmdUtil.instance.byteToInt(data[1])
+//            val data2 = SRBleCmdUtil.instance.byteToInt(data[2])
+//            val data3 = SRBleCmdUtil.instance.byteToInt(data[3])
+//            val data4 = SRBleCmdUtil.instance.byteToInt(data[4])
+//            val ip = "$data1.$data2.$data3.$data4"
+//            val port = SRBleCmdUtil.instance.byte2ArrayToInt(data.sliceArray(5..6))
+//            val socketAddress = "$ip:$port"
+//            LogUtil.e(socketAddress)
+//            mMac = mac
+//            mNeedSendMessage = data.sliceArray(8..data.size - 2)
+//            initEasySocket(context, ip, port)
+//        } catch (e: Exception) {
+//            LogUtil.e("initEasySocket 异常:${e.message}")
+//        }
    }

    /**
--- a/app/src/main/java/com/abbidot/tracker/wxapi/WXBaseActivity.kt
+++ b/app/src/main/java/com/abbidot/tracker/wxapi/WXBaseActivity.kt
@@ -3,6 +3,7 @@ package com.abbidot.tracker.wxapi
 import android.content.Intent
 import android.os.Bundle
 import androidx.fragment.app.FragmentActivity
+import com.abbidot.baselibrary.util.LogUtil
 import com.abbidot.tracker.util.ThirdPartyUtil
 import com.tencent.mm.opensdk.modelbase.BaseReq
 import com.tencent.mm.opensdk.modelbase.BaseResp
@@ -17,13 +18,25 @@ open class WXBaseActivity : FragmentActivity(), IWXAPIEventHandler {

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
-        ThirdPartyUtil.mApi.handleIntent(intent, this)
+        // 使用微信SDK官方 handleIntent 校验，这是最可靠的合法性判断
+        // handleIntent 内部会校验 AppID、签名、Intent 数据格式等
+        val handled = ThirdPartyUtil.mApi.handleIntent(intent, this)
+        if (!handled) {
+            LogUtil.e("WXBaseActivity", "onCreate 收到非法微信回调 Intent，直接结束")
+            finish()
+            return
+        }
        initData()
    }

    override fun onNewIntent(intent: Intent) {
        super.onNewIntent(intent)
-        ThirdPartyUtil.mApi.handleIntent(intent, this)
+        // singleTask/singleTop 模式下新 Intent 到达，同样走官方校验
+        val handled = ThirdPartyUtil.mApi.handleIntent(intent, this)
+        if (!handled) {
+            LogUtil.e("WXBaseActivity", "onNewIntent 收到非法微信回调 Intent，直接结束")
+            finish()
+        }
    }

    override fun onReq(baseReq: BaseReq?) {