fix(android): Add filterTouchesWhenObscured to prevent Tapjacking by abhishek-900 ยท Pull Request #5155 ยท getsentry/sentry-java

Adds filterTouchesWhenObscured="true" to the user feedback dialog to prevent overlay/tapjacking attack ( CWE-1021)

๐Ÿ“œ Description

Adds android:filterTouchesWhenObscured="true" attribute to the root RelativeLayout in sentry_dialog_user_feedback.xml to mitigate tapjacking/overlay attacks.

๐Ÿ’ก Motivation and Context

Without filterTouchesWhenObscured, a malicious app can draw an invisible overlay on top of the user feedback dialog. This allows attackers to intercept user input or trick users into unintended actions (tapjacking).

This is flagged by static security scanners as a medium severity vulnerability (CWE-1021: Improper Restriction of Rendered UI Layers).

Reference: https://developer.android.com/reference/android/view/View#security

๐Ÿ’š How did you test it?

  • Verified XML syntax is valid
  • Manual visual inspection of the attribute placement

๐Ÿ“ Checklist

  • I added GH Issue ID & Linear ID
  • I added tests to verify the changes.
  • No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
  • I updated the docs if needed.
  • I updated the wizard if needed.
  • Review from the native team if needed.
  • No breaking change or entry added to the changelog.
  • No breaking change for hybrid SDKs or communicated to hybrid SDKs.

๐Ÿ”ฎ Next steps

N/A - This is a one-line security hardening fix with no follow-up required.