From a6bf9d2e2f0f6b8111877336536ce2854d304749 Mon Sep 17 00:00:00 2001 From: Tangem Date: Fri, 22 May 2026 14:03:52 +0300 Subject: [PATCH 1/3] Updated on 2026-08-14 --- gradle/tangem_dependencies.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gradle/tangem_dependencies.toml b/gradle/tangem_dependencies.toml index 76d48569f9..6741f7e5f8 100644 --- a/gradle/tangem_dependencies.toml +++ b/gradle/tangem_dependencies.toml @@ -5,7 +5,7 @@ # https://github.com/tangem/tangem-sdk-android/ # https://github.com/tangem/vico -tangemBlockchainSdk = "releases-5.38-1512" +tangemBlockchainSdk = "releases-5.38-1523" #tangemBlockchainSdk = "0.0.1" # Keep it! - used for local builds tangemCardSdk = "releases-5.38-615" #tangemCardSdk = "0.0.1" # Keep it! - used for local builds ^ From e181c5a1a7bca8781b469bd0ab7da02ae4dff492 Mon Sep 17 00:00:00 2001 From: Tangem Date: Mon, 25 May 2026 19:16:04 +0300 Subject: [PATCH 2/3] Updated on 2026-08-14 --- .../deeplink/DefaultDeeplinkLauncher.kt | 14 ++++++++++- .../tangem/common/uri/ExternalUrlValidator.kt | 11 +++++++-- .../common/uri/ExternalUrlValidatorTest.kt | 23 ++++++++++++++++++- 3 files changed, 44 insertions(+), 4 deletions(-) diff --git a/app/src/main/java/com/tangem/tap/common/deeplink/DefaultDeeplinkLauncher.kt b/app/src/main/java/com/tangem/tap/common/deeplink/DefaultDeeplinkLauncher.kt index ce74ae1064..0b6f9c503e 100644 --- a/app/src/main/java/com/tangem/tap/common/deeplink/DefaultDeeplinkLauncher.kt +++ b/app/src/main/java/com/tangem/tap/common/deeplink/DefaultDeeplinkLauncher.kt @@ -5,6 +5,7 @@ import android.content.Intent import android.net.Uri import androidx.core.net.toUri import com.tangem.common.routing.DeepLinkScheme +import com.tangem.common.uri.ExternalUrlValidator import com.tangem.core.navigation.deeplink.DeeplinkLauncher import com.tangem.core.navigation.url.UrlOpener import com.tangem.utils.logging.TangemLogger @@ -24,7 +25,18 @@ internal class DefaultDeeplinkLauncher( DeepLinkScheme.Tangem.scheme, DeepLinkScheme.WalletConnect.scheme, -> launchDeepLink(deeplinkUri) - DeepLinkScheme.Https.scheme -> launchDeeplinkOrOpenBrowser(deeplinkUri, link) + DeepLinkScheme.Https.scheme -> { + if (ExternalUrlValidator.isUriTrusted(link)) { + launchDeeplinkOrOpenBrowser(deeplinkUri, link) + } else { + TangemLogger.i( + """ + Untrusted HTTPS link dropped + |- Received URI: $deeplinkUri + """.trimIndent(), + ) + } + } else -> { TangemLogger.i( """ diff --git a/common/src/main/kotlin/com/tangem/common/uri/ExternalUrlValidator.kt b/common/src/main/kotlin/com/tangem/common/uri/ExternalUrlValidator.kt index 49785fb80e..467a7493f0 100644 --- a/common/src/main/kotlin/com/tangem/common/uri/ExternalUrlValidator.kt +++ b/common/src/main/kotlin/com/tangem/common/uri/ExternalUrlValidator.kt @@ -11,14 +11,21 @@ import java.net.URI */ object ExternalUrlValidator { - private val trustedHost: List = listOf("tangem.com") + private val trustedHosts: Set = setOf( + "tangem.com", + "www.tangem.com", + "buy.tangem.com", + "app.tangem.com", + "tangem.surveysparrow.com", + "feedback.tangem.com", + ) /** Check if [externalUri] is trusted */ fun isUriTrusted(externalUri: String): Boolean { return try { val uri = URI.create(externalUri) - uri.scheme == "https" && uri.host in trustedHost + uri.scheme == "https" && uri.host in trustedHosts } catch (e: Exception) { val exception = IllegalStateException("Failed to validate URI: $externalUri", e) diff --git a/common/src/testDebug/kotlin/com/tangem/common/uri/ExternalUrlValidatorTest.kt b/common/src/testDebug/kotlin/com/tangem/common/uri/ExternalUrlValidatorTest.kt index f03d64dde6..ab2e743adf 100644 --- a/common/src/testDebug/kotlin/com/tangem/common/uri/ExternalUrlValidatorTest.kt +++ b/common/src/testDebug/kotlin/com/tangem/common/uri/ExternalUrlValidatorTest.kt @@ -23,11 +23,32 @@ class ExternalUrlValidatorTest(private val model: Model) { @JvmStatic @Parameterized.Parameters fun data(): Collection = listOf( + // Trusted hosts — exact match Model(url = "https://tangem.com", expected = true), - Model(url = "https://tange.com", expected = false), + Model(url = "https://tangem.com/pricing/?promocode=tgapp20ups", expected = true), + Model(url = "https://www.tangem.com", expected = true), + Model(url = "https://app.tangem.com", expected = true), + Model(url = "https://buy.tangem.com/?promocode=NEWINAPP", expected = true), + Model(url = "https://feedback.tangem.com", expected = true), + Model(url = "https://tangem.surveysparrow.com/s/tangem-pay/tt-F8XXH", expected = true), + // Subdomains not on the list + Model(url = "https://express.tangem.com/v1/", expected = false), Model(url = "https://fake.tangem.com", expected = false), + Model(url = "https://join.tangem.com", expected = false), + // Sibling hosts on the same registrable parent + Model(url = "https://surveysparrow.com", expected = false), + Model(url = "https://fake.surveysparrow.com", expected = false), + // Suffix-injection attempts + Model(url = "https://tangem.com.attacker.com", expected = false), + Model(url = "https://faketangem.com", expected = false), + Model(url = "https://buy.tangem.com.attacker.com", expected = false), + // Wrong scheme Model(url = "http://tangem.com", expected = false), + Model(url = "http://buy.tangem.com", expected = false), + // Typos + Model(url = "https://tange.com", expected = false), Model(url = "http://tandem.com", expected = false), + // Garbage Model(url = "adawdawdassdw", expected = false), ) From b6c5a4180c31436586b9afb0c4385c6163cb5502 Mon Sep 17 00:00:00 2001 From: Tangem Date: Mon, 25 May 2026 16:16:27 +0000 Subject: [PATCH 3/3] Updated on 2026-08-14 --- gradle/tangem_dependencies.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gradle/tangem_dependencies.toml b/gradle/tangem_dependencies.toml index 6741f7e5f8..257bb0ac32 100644 --- a/gradle/tangem_dependencies.toml +++ b/gradle/tangem_dependencies.toml @@ -5,9 +5,9 @@ # https://github.com/tangem/tangem-sdk-android/ # https://github.com/tangem/vico -tangemBlockchainSdk = "releases-5.38-1523" +tangemBlockchainSdk = "develop-1520" #tangemBlockchainSdk = "0.0.1" # Keep it! - used for local builds -tangemCardSdk = "releases-5.38-615" +tangemCardSdk = "develop-614" #tangemCardSdk = "0.0.1" # Keep it! - used for local builds ^ tangemVico = "tangem-master-21" #tangemVico = "0.0.1" # Keep it! - used for local builds ^