Jami Android App can dangerously scan and add any QR Code

Describe your environment

Please specify the following:

• Jami version: 20240506-01
• Device model: Pixel 7a
• Android version: 14
• What build you are using: your own (commit id = 04117d84 + daemon commit id = aa24a6db)]

Steps to reproduce

• Can you reproduce the bug: [at will]
• Steps:
  1. Generate a QR Code for the text "Hello World" using any free online service 2. Scan that QR Code in jami app while adding a new contact ...
• Actual result: The Jami app would try to add a new contact with uri jami:jami:Hello World
• Expected result: The Jami app should be restricted to scanning only jami QR Codes and should display error for non-jami QR Codes

Additional information

Very Dangerous: Once a contact is added using wrong QR Code, you can't delete that account from the app. i.e: A contact "jami:Hello World" once added, would stay forever in your contact list.

changed title from Jami Android App can scan and add any QR Code to Jami Android App can dangerously scan and add any QR Code

Got these logs while trying to delete that jami:Hello World contact

AccountService          cx.ring    removeContact() 37V4f5F1ctdc6bfc jami:Hello World ban:false
account_manager.cpp     cx.ring    removeContact: invalid contact URI

Follow up: https://review.jami.net/c/jami-client-android/+/28306

added SprintTo review label

assigned to @aberaud

added BacklogHigh bug labels

Fix is now merged, will be in next release

removed BacklogHigh label

added SprintDone label and removed SprintTo review label

closed

marked this issue as related to #1721 (closed)