Return defensive copy of data in RemoteMessage

nidhidavawala · web-flow · commit 0c0a3f808dae · 2025-10-22T16:53:16.000-07:00
b/438714642: This change ensures we do not return the internal map but rather a defensive copy of data. Makes our code less vulnerable.
diff --git a/firebase-messaging/src/main/java/com/google/firebase/messaging/RemoteMessage.java b/firebase-messaging/src/main/java/com/google/firebase/messaging/RemoteMessage.java
@@ -131,7 +131,7 @@ public Map<String, String> getData() {
     if (data == null) {
       data = MessagePayloadKeys.extractDeveloperDefinedPayload(bundle);
     }
-    return data;
+    return new HashMap<>(data);
   }
 
   /** @hide */

Original file line number	Diff line number	Diff line change
`@@ -131,7 +131,7 @@ public Map<String, String> getData() {`
`131`	`131`	`if (data == null) {`
`132`	`132`	`data = MessagePayloadKeys.extractDeveloperDefinedPayload(bundle);`
`133`	`133`	`}`
`134`		`- return data;`
	`134`	`+ return new HashMap<>(data);`
`135`	`135`	`}`
`136`	`136`
`137`	`137`	`/** @hide */`