Revision control
+ // Copyright (C) 2026 The Qt Company Ltd.
+ // SPDX-License-Identifier: LicenseRef-Qt-Commercial OR GFDL-1.3-no-invariants-only
+
+ /*!
+ \page android-security.html
+ \title Android Security Considerations
+ \brief Security considerations when writing Qt applications for Android.
+ \ingroup security
+
+ Other applications on the device reach a Qt for Android application through
+ intents, activity results, and the clipboard. Qt passes the data from these
+ channels to your application unchanged, but it does not check whether the
+ data is safe to use. This page describes what each channel exposes and what
+ your application must check.
+
+ Qt for Android treats the Android system as trusted and every other
+ application as untrusted, so everything arriving on these channels is
+ \l{Handling Untrusted Data}{untrusted data}. For how this fits into the
+ wider division of responsibility, see the \l{Qt Shared Security Model}. For
+ the tools that build your application, see
+ \l{Using Qt's Developer Tools Securely}.
+
+ \section1 Incoming intents
+
+ Qt handles intents whose action is \c ACTION_VIEW. It takes the intent's
+ data URI and passes it to QDesktopServices::openUrl(), which dispatches to
+ the handler you registered with QDesktopServices::setUrlHandler(). Qt does
+ not validate that URI, because only your application knows which schemes,
+ hosts, and paths are meaningful to it.
+
+ If you declare a matching intent filter, any application on the device can
+ start your activity with any URI it chooses. A web page can also start your
+ activity through a link. Validate the scheme, the host, and the path before
+ you use them. Never treat a path from a URI as a trusted file system
+ location.
+
+ \section1 Activity results
+
+ When you start another activity for a result, Qt passes the returned intent
+ to your result callback unchanged. Qt does not inspect it. The activity that
+ produced the result might not be the one you expected, because any
+ application can register for the same action.
+
+ Check the request code, check the result code, and validate the intent's
+ contents before using them.
+
+ \section1 Clipboard content
+
+ QClipboard on Android reads the system clipboard, which any application can
+ write. A QMimeData obtained from it can carry any format and any payload
+ those applications chose to put there.
+
+ Treat clipboard content like a downloaded file. Validate it before you
+ render it as markup, pass it to a shell, or build a file path from it.
+
+ \section1 Recommendations
+
+ \list
+ \li \b{Validate at the entry point.} Validate data in the URL handler,
+ in the activity result receiver, and where you read the clipboard.
+ Deeper in the application, the origin of the data is no longer
+ clear.
+ \li \b{Declare only the intent filters you need.} Every filter widens
+ the set of applications that can reach you, and an exported
+ activity is reachable by any application on the device.
+ \li \b{Prefer allowlists.} Accept the schemes, hosts, and MIME types
+ you support and reject everything else. Do not try to list all
+ dangerous values.
+ \li \b{Do not infer trust from the channel.} A URI from an intent does
+ not show who sent it.
+ \endlist
+ */