Be Careful of Drag-and-Drop on Android N
As part of a forthcoming book update, I began working
with the revised drag-and-drop APIs for Android N. Drag-and-drop has
been part of Android since 3.0, but since it is limited to a single
activity, it does not seem to be all that popular. Now, with multi-window
support, drag-and-drop can work between apps��� and that is where
you need to be careful.
When you start a drag-and-drop operation via startDragAndDrop()
(or the earlier startDrag()), you can include DRAG_FLAG_GLOBAL
in the request. This indicates that you want the drag-and-drop operation
to work between apps. Without this flag, the drag-and-drop is limited
to your own app. This is wonderful: it is an easy change, but apps
do not accidentally leak data by default.
However, I cannot find an equivalent for handling drops.
When you register a drop target with setOnDragListener(), there is
no flag to say that you want to support cross-app drag-and-drop requests
When you get a DragEvent, there is no built-in means to determine
whether the event arose from your app or from another app
Hence, if you implement drag-and-drop,
you can get drag events originating from other apps on Android N,
without any changes to your code to say that you want this behavior.
IMHO, this is not a good idea. Accepting foreign drag events should
be something you opt into. With luck,
this will get addressed,
though I do not hold out tons of hope.
If you have been using drag-and-drop purely within your app, and you
want your drop target to know whether a DragEvent is from your app
or from another app, you can use a slight hack: pass a non-null
value for the third parameter to startDrag()/startDragAndDrop().
This is called the ���local state���, and the name is accurate: it does not appear
to be passed across process boundaries. For any DragEvent delivered to your
drop target, you can call getLocalState() on the DragEvent to get
the local state value. If that is not null, then you know the
DragEvent initiated in your app. If the local state is null ���
and you are sure that you are providing a value for it in all of your
startDrag()/startDragAndDrop() calls ��� then you know that the
DragEvent came from another app.
Ideally, eventually you support cross-app drag-and-drop. But, since you
are not in control over DragEvent objects originating from other
apps, you will need a lot more defensive programming in your drop target
code. You might be expecting a Uri and get a String, for example.
