Return copy of data in getData() method of RemoteMessage.java (#7513)

nidhidavawala · web-flow · commit e9e5655f987c · 2025-10-30T13:56:37.000-07:00
This change returns a copy of internal data in RemoteMessage, making our
code less vulnerable. Tracking bug: b/438714642
diff --git a/firebase-messaging/src/main/java/com/google/firebase/messaging/RemoteMessage.java b/firebase-messaging/src/main/java/com/google/firebase/messaging/RemoteMessage.java
@@ -35,6 +35,7 @@
 import com.google.firebase.messaging.Constants.MessagePayloadKeys;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
+import java.util.HashMap;
 import java.util.Map;
 
 /**
@@ -131,7 +132,7 @@ public Map<String, String> getData() {
     if (data == null) {
       data = MessagePayloadKeys.extractDeveloperDefinedPayload(bundle);
     }
-    return data;
+    return new HashMap<>(data);
   }
 
   /** @hide */

Original file line number	Diff line number	Diff line change
`@@ -35,6 +35,7 @@`
`35`	`35`	`import com.google.firebase.messaging.Constants.MessagePayloadKeys;`
`36`	`36`	`import java.lang.annotation.Retention;`
`37`	`37`	`import java.lang.annotation.RetentionPolicy;`
	`38`	`+import java.util.HashMap;`
`38`	`39`	`import java.util.Map;`
`39`	`40`
`40`	`41`	`/**`
`@@ -131,7 +132,7 @@ public Map<String, String> getData() {`
`131`	`132`	`if (data == null) {`
`132`	`133`	`data = MessagePayloadKeys.extractDeveloperDefinedPayload(bundle);`
`133`	`134`	`}`
`134`		`- return data;`
	`135`	`+ return new HashMap<>(data);`
`135`	`136`	`}`
`136`	`137`
`137`	`138`	`/** @hide */`