[cynthiajoan]

Description

Hardens RemoteMessage.fromMap (packages/firebase_messaging/firebase_messaging_platform_interface/lib/src/remote_message.dart) and RemoteNotification.fromMap / AndroidNotification.fromMap / AppleNotification.fromMap / AppleNotificationSound.fromMap / WebNotification.fromMap (packages/firebase_messaging/firebase_messaging_platform_interface/lib/src/remote_notification.dart) against non-string scalar values, non-list locArgs, and epoch-seconds or non-integer sentTime values across platform channels.

Why this is needed

• RemoteMessage.fromMap already used ?.toString() for messageId (map['messageId']?.toString(), with the comment "using toString on messageId as it can be an int or string when being sent from native"), because APNs and platform channels can deserialize numeric JSON/plist values (senderId, category, collapseKey, badge, title, body, etc.) as num or bool rather than String. However, all other string fields on RemoteMessage and RemoteNotification performed implicit dynamic as String? casts, and _toList called List<String>.from(value) directly (throwing TypeError if locArgs is a single scalar or contains non-string elements such as numbers).
• For sentTime, RemoteMessage.fromMap previously ran:

  DateTime.fromMillisecondsSinceEpoch(int.parse(map['sentTime'].toString()))

  1. On Apple platforms (FLTFirebaseMessagingPlugin.m), sentTime is extracted from APNs userInfo[@"google.c.a.ts"], which is a 10-digit Unix timestamp in seconds (whereas Android's RemoteMessage.getSentTime() is in milliseconds). Interpreting a 10-digit seconds value directly as milliseconds produces a DateTime in January 1970 (1970-01-20).
  2. If sentTime is a non-integer string, int.parse throws an uncaught FormatException during message delivery.

Why this does not break existing SDK behavior

• All well-typed String, bool, int, num, List<String>, and Map values produce the exact same RemoteMessage and RemoteNotification fields as before (including all 99 existing unit tests in firebase_messaging_platform_interface).
• 13-digit millisecond sentTime values (and 0 or negative values) are unchanged; only positive timestamps strictly below 10000000000 (10^10, i.e., 10-digit epoch seconds) are multiplied by 1000 to convert seconds to milliseconds, and unparseable/out-of-range values return null instead of throwing FormatException or ArgumentError.

Verification

• Red (before fix, on 387c707b2 with only the new tests): flutter test --no-pub fails with:

  type 'int' is not a subtype of type 'String?' in type cast (RemoteNotification.fromMap, remote_notification.dart:31:14)
  type 'int' is not a subtype of type 'String?' in type cast (RemoteMessage.fromMap, remote_message.dart:30:17)
  

• Green (with fix, at a2be89cbb):
  • dart format --output=none --set-exit-if-changed . (0 changes)
  • dart analyze --fatal-infos . (0 issues)
  • flutter test --no-pub in firebase_messaging_platform_interface (101 passed, 0 failed)

Related Issues

N/A

Checklist

Before you create this PR confirm that it meets all requirements listed below by checking the relevant checkboxes ([x]).
This will ensure a smooth and quick review process. Updating the pubspec.yaml and changelogs is not required.

• I read the Contributor Guide and followed the process outlined there for submitting PRs.
• My PR includes unit or integration tests for all changed/updated/fixed behaviors (See Contributor Guide).
• All existing and new tests are passing.
• I updated/added relevant documentation (doc comments with ///).
• The analyzer (melos run analyze) does not report any problems on my PR.
• I read and followed the Flutter Style Guide.
• I signed the CLA.
• I am willing to follow-up on review comments in a timely manner.

Breaking Change

Does your PR require plugin users to manually update their apps to accommodate your change?

• Yes, this is a breaking change.
• No, this is not a breaking change.

[gemini-code-assist]

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.