Android : Unsafe StickyBroadcast
Classification
Overview
The application uses sticky broadcasts. Such broadcasts are not compatible with the permission mechanism and are available to any receiver. Sticky broadcast is deprecated since API Level 21 and is not recommended for use.
Sticky broadcasts were used to ensure that the application that registered the message receiver of a certain type could get even those messages that were sent when the application had not been launched yet. This mechanism was used, for example, for the application to be able to get a message about the current battery level after launching: this information was distributed through sticky broadcasts. However, the broadcasts of this type do not provide security: any application has access to them. Therefore, starting with API Level 21, creating custom sticky broadcast is not recommended. To notify the application that some event has occurred, it is recommended to use regular broadcasts; to notify the application about the current state of the system, it is recommended to use other mechanisms. For example, the information about the current battery level can be obtained via batteryStatus.getIntExtra(BatteryManager.EXTRA_LEVEL, -1) and batteryStatus.getIntExtra(BatteryManager.EXTRA_SCALE, -1).
