Improve handling my link when not logged in

[jpelgrom]

Summary

Prevent unexpected behavior when using MyActivity outside the happy flow.

Screenshots

n/a

Link to pull request in Documentation repository

n/a

Any other notes

[dshokouhi]

Good to be specific here

[firmianay]

Hello developers,
This patch appears to address this vulnerability, and GitHub Security Lab has not released their report yet.
I have some questions, because the manifest has already restricted the Intent that calls this component. Why do I need to check it again in the code, Or is this just a casual thing, The main vulnerability mitigation point is !serverManager.isRegistered()?

        <activity android:name=".launch.my.MyActivity"
            android:exported="true">
            <intent-filter android:autoVerify="true">
                <action android:name="android.intent.action.VIEW" />
                <category android:name="android.intent.category.DEFAULT" />
                <category android:name="android.intent.category.BROWSABLE" />

                <data
                    android:scheme="https"
                    android:host="my.home-assistant.io"
                    android:pathPrefix="/redirect/"/>
            </intent-filter>
        </activity>

[jpelgrom]

@firmianay GHSL has released a blog post with details now. While during normal use the added check is unnecessary, the specific domain check is to prevent the described, targeted use of this activity to load another URL and gain access to the app's webview.

If you have any more questions after reading the blog post, feel free to ask in #devs_mobile_apps on the Home Assistant Discord.