android - Activity exported=false listed in activity chooser

Question

I have two similar applications (one free, one paid).

An activity is defined with exported="false"

    <activity
        android:name=".MyActivity"
        android:exported="false"
        android:noHistory="true" >
        <intent-filter>
            <action android:name="android.intent.action.VIEW" />
            <category android:name="android.intent.category.DEFAULT" />
            <data android:mimeType="vnd.android.cursor.item/vnd.mine" />
        </intent-filter>
    </activity>

When I call startActivity with the appropriate implicit intent from the free app, the activity picker appears.

I don't understand why the activity from the paid app appears, since it is exported="false"

I suppose I can add an intent filter based on the URL, but my question is: why does the activity from the other app appear when the doc reads

Whether or not the activity can be launched by components of other applications

Answer 1

I don't understand why the activity from the paid app appears, since it is exported="false"

Because you have a matching <intent-filter>. Since you do not need the <intent-filter> for a non-exported activity, simply delete it and use an explicit Intent when starting this activity.

why does the activity from the other app appear when the doc reads...

I had the same question and was told that this was expected behavior and the bug is in our app for having a useless <intent-filter>. Quoting Dianne Hackborn:

I would generally consider this a bug in the app -- if you have an activity that you aren't allowing other apps to launch, why the heck are you publishing an intent filter that they will match to try to launch? The security of the activity (whether it is not exported or requires a permission) is not part of intent matching. ...this scenario (publishing an activity that matches intents other applications will use but then restricting it to not be launchable by other applications) is not useful if not outright broken.