Skip to content

[Android] Refactor Intent-driven engine flags into a variant-specific module - #191924

Merged
auto-submit[bot] merged 26 commits into
flutter:masterfrom
gmackall:demo_source_manip
Oct 3, 2026
Merged

auto-submit[bot] merged 26 commits into
flutter:masterfrom
gmackall:demo_source_manip

Conversation

@gmackall

@gmackall gmackall commented Aug 27, 2026 •

Copy link
Copy Markdown
Member

Configures the Android embedding to ignore engine configuration flags set via Intent in release mode. All flag parsing from Intents is also stripped from release engine binaries as an additional security measure. Also adds an integration test to ensure flags set via Intent are ignored for apps running in release mode.

As part of this implementation, deprecates the internal interface method FlutterActivityAndFragmentDelegate.Host.getFlutterShellArgs which is to be replaced byFlutterActivityAndFragmentDelegate.Host.getFlutterEngineFlags. After a stable release, getFlutterShellArgs will be removed: #193256. This is not a breaking change; developers cannot override this interface. They can only subclass FlutterActivity and FlutterFragment and call getFlutterShellArgs which will still work as intended with a deprecation notice.

Fixes #190461.

Related issue: While working on this, I thought it would be good to track adding the ability to negate all flags because currently, presence-only boolean flags (like --trace-startup) cannot have their setting in the manifest negated by the command line, which is counter-intuitive: #193354

Related PR: Made some updates to the breaking change page for this project for flutter/website#13931 (directly related to my Flutter-Android-Engine-Flags.md‎ updates)

(@camsim99 authored description)

Pre-launch Checklist

  • I read the [Contributor Guide] and followed the process outlined there for submitting PRs.
  • I read the [AI contribution guidelines] and understand my responsibilities, or I am not using AI tools.
  • I read the [Tree Hygiene] wiki page, which explains my responsibilities.
  • I read and followed the [Flutter Style Guide], including [Features we expect every widget to implement].
  • I signed the [CLA].
  • I listed at least one issue that this PR fixes in the description above.
  • I updated/added relevant documentation (doc comments with ///).
  • I added new tests to check the change I am making, or this PR is [test-exempt].
  • I followed the [breaking change policy] and added [Data Driven Fixes] where supported.
  • All existing and new tests are passing.

@github-actions github-actions Bot added platform-android Android applications specifically engine flutter/engine related. See also e: labels. team-android Owned by Android platform team labels Aug 27, 2026
@camsim99 camsim99 changed the title Refactor Intent-driven engine flags into a variant-specific module [Android] Refactor Intent-driven engine flags into a variant-specific module Sep 23, 2026
@github-actions github-actions Bot added team-engine Owned by Engine team d: docs/ flutter/flutter/docs, for contributors labels Sep 23, 2026
@camsim99 camsim99 added the CICD Run CI/CD label Sep 23, 2026

@camsim99 camsim99 Sep 23, 2026 •

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The edits here are not due to new behavior introduced in this PR. However, I took the opportunity of this PR to clarify how precedence actually works & include the release-mode restrictions that this PR is part of implementing.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding missing flag here....

@camsim99
camsim99 marked this pull request as ready for review September 28, 2026 17:42
@camsim99
camsim99 requested a review from a team as a code owner September 28, 2026 17:42
@camsim99
camsim99 requested review from mboetger and reidbaker and removed request for a team and reidbaker September 28, 2026 17:42

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request deprecates FlutterShellArgs in favor of getFlutterEngineFlags(), which retrieves engine flags as a list of strings, and introduces FlutterEngineFlagsProvider with separate debug and release implementations to parse flags from Intent extras. Feedback on these changes highlights potential BadParcelableException crashes (Denial of Service) when calling extras.keySet() on untrusted intents in both debug and release providers. Additionally, a potential NullPointerException was identified in isGetFlutterShellArgsOverridden when using Mockito mocks or spies in unit tests, as mock subclasses trigger the override check and return null for unstubbed getFlutterShellArgs() calls.

@camsim99

Copy link
Copy Markdown
Contributor

To reviewers: Google testing passed, I just need to get approval on the g3fix!

camsim99 added a commit to flutter/website that referenced this pull request Sep 30, 2026
…flags (#13931)

_Description of what this PR is changing or adding, and why:_
Adds some corrections +renames to a breaking change page on restricting
engine config flags for Android.

_Issues fixed by this PR (if any):_
Part of flutter/flutter#190461

_PRs or commits this PR depends on (if any):_
flutter/flutter#191924 (but this can land at any
time)

## Presubmit checklist

- [x] If you are unwilling, or unable, to sign the CLA, even for a
_tiny_, one-word PR, please file an issue instead of a PR.
- [x] If this PR is not meant to land until a future stable release,
mark it as draft with an explanation.
- [x] This PR follows the [Google Developer Documentation Style
Guidelines](https://developers.google.com/style)—for example, it doesn't
use _i.e._ or _e.g._, and it avoids _I_ and _we_ (first-person
pronouns).
- [x] This PR uses [semantic line
breaks](https://github.com/dart-lang/site-shared/blob/main/doc/writing-for-dart-and-flutter-websites.md#semantic-line-breaks)
  of 80 characters or fewer.

---------

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
@camsim99
camsim99 requested a review from mboetger September 30, 2026 19:41
@camsim99 camsim99 added the autosubmit Merge PR when tree becomes green via auto submit App label Oct 2, 2026
@auto-submit
auto-submit Bot added this pull request to the merge queue Oct 2, 2026
Merged via the queue into flutter:master with commit 38e799a Oct 3, 2026
22 of 23 checks passed
@flutter-dashboard flutter-dashboard Bot removed the autosubmit Merge PR when tree becomes green via auto submit App label Oct 3, 2026
suryaKommana2662 pushed a commit to suryaKommana2662/flutter that referenced this pull request Oct 29, 2026
… module (flutter#191924)

Configures the Android embedding to ignore engine configuration flags
set via `Intent` in release mode. All flag parsing from `Intent`s is
also stripped from release engine binaries as an additional security
measure. Also adds an integration test to ensure flags set via `Intent`
are ignored for apps running in release mode.

As part of this implementation, deprecates the internal interface method
`FlutterActivityAndFragmentDelegate.Host.getFlutterShellArgs` which is
to be replaced
by`FlutterActivityAndFragmentDelegate.Host.getFlutterEngineFlags`. After
a stable release, `getFlutterShellArgs` will be removed:
flutter#193256. **This is not a
breaking change; developers cannot override this interface.** They can
only subclass `FlutterActivity` and `FlutterFragment` and call
`getFlutterShellArgs` which will still work as intended with a
deprecation notice.

Fixes flutter#190461.

Related issue: While working on this, I thought it would be good to
track adding the ability to negate all flags because currently,
presence-only boolean flags (like `--trace-startup`) cannot have their
setting in the manifest negated by the command line, which is
counter-intuitive: flutter#193354

Related PR: Made some updates to the breaking change page for this
project for flutter/website#13931 (directly
related to my `Flutter-Android-Engine-Flags.md‎` updates)

(@camsim99 authored description)

## Pre-launch Checklist

- [x] I read the [Contributor Guide] and followed the process outlined
there for submitting PRs.
- [x] I read the [AI contribution guidelines] and understand my
responsibilities, or I am not using AI tools.
- [x] I read the [Tree Hygiene] wiki page, which explains my
responsibilities.
- [x] I read and followed the [Flutter Style Guide], including [Features
we expect every widget to implement].
- [x] I signed the [CLA].
- [x] I listed at least one issue that this PR fixes in the description
above.
- [x] I updated/added relevant documentation (doc comments with `///`).
- [x] I added new tests to check the change I am making, or this PR is
[test-exempt].
- [x] I followed the [breaking change policy] and added [Data Driven
Fixes] where supported.
- [x] All existing and new tests are passing.

---------

Co-authored-by: Camille Simon <[email protected]>
Co-authored-by: Camille Simon <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CICD Run CI/CD d: docs/ flutter/flutter/docs, for contributors engine flutter/engine related. See also e: labels. platform-android Android applications specifically team-android Owned by Android platform team team-engine Owned by Engine team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Android] Restrict engine flags via Intent extras to non-release modes

3 participants