Problem

TurboSessionNavHostFragment.ensureDeeplinkStartLocationValid() validates the start location only inside the deepLinkExtras intent extra (android-support-nav:controller:deepLinkExtras).

AndroidX NavController also reads a second extra — deepLinkArgs (android-support-nav:controller:deepLinkArgs) — and merges it over deepLinkExtras when assembling each destination's arguments (arguments.putAll(globalArgs) followed by arguments.putAll(deepLinkArgs[index]), so the later write wins). Because an exported Activity's launch intent is externally controllable, a location (or any other argument) supplied via deepLinkArgs overrides the validated value and becomes the session's start destination — loading an unvalidated URL into the host's WebView.

This ports hotwired/hotwire-native-android#200 to turbo-android.

Fix

ensureDeeplinkStartLocationValid() now sanitizes the launching intent's deepLinkArgs in addition to validating deepLinkExtras:

• each deepLinkArgs per-destination bundle is emptied so it can't override the validated start location;
• a deepLinkExtras start location whose host doesn't match the configured start host is reverted to the configured start location, as before.

Sanitization applies to every launching intent. Intent-origin signals are too weak to gate on — callingPackage is only set for startActivityForResult launches, and Activity.referrer is backed by the attacker-settable EXTRA_REFERRER — so there is no reliable way to distinguish app-produced intents from external ones. Unconditional sanitization keeps legitimate same-host start locations working while preventing an external intent from steering the session to an arbitrary URL.

Tests

TurboSessionNavHostFragmentTest covers:

• an off-host start location is reverted to the configured one;
• a same-host start location is preserved;
• deepLinkArgs are emptied so they can't override the validated start location.

🤖 Generated with Claude Code