test(rcs): cover the URL check throwing on the listener's warning path

The crash fix that wrapped launchUrlSafetyWarning's link check in
try/catch had no test, because nothing could make the check throw.
RcsNotificationListener.urlCheck is now a replaceable seam, the same
shape as CommunityContributor.transport, defaulting to
UrlSafetyChecker.checkSmsBody with the same arguments.

The new test in RcsNotificationListenerTest posts a chat notification
with a link through onNotificationPosted while the check throws, and
fails if anything reaches the default uncaught exception handler. A
control run with the try/catch removed fails it with both escaped
throws. The test is added to an existing file; no existing test changed.

Author: SysAdminDoc

README.md

@@ -12,7 +12,7 @@
 <p align="center">
   <a href="https://github.com/SysAdminDoc/CallShield/releases/latest"><img src="https://img.shields.io/github/v/release/SysAdminDoc/CallShield?style=flat-square&color=a6e3a1" alt="Release"></a>
   <img src="https://img.shields.io/badge/Spam%20Numbers-51%2C403-f38ba8?style=flat-square" alt="51,403 Numbers">
-  <img src="https://img.shields.io/badge/JVM%20unit%20tests-2054-94e2d5?style=flat-square" alt="2054 JVM unit tests">
+  <img src="https://img.shields.io/badge/JVM%20unit%20tests-2055-94e2d5?style=flat-square" alt="2055 JVM unit tests">
   <img src="https://img.shields.io/badge/Android-10%2B-89b4fa?style=flat-square" alt="Android 10+">
   <img src="https://img.shields.io/badge/License-MIT-cba6f7?style=flat-square" alt="MIT License">
   <img src="https://img.shields.io/badge/API%20Keys-None-fab387?style=flat-square" alt="No required API keys">
@@ -592,12 +592,12 @@ RELEASE_KEY_PASSWORD=...
 ## Testing
 
 ```bash
-./gradlew testDebugUnitTest   # 2054 tests
+./gradlew testDebugUnitTest   # 2055 tests
 ./gradlew connectedDebugAndroidTest -Pandroid.testInstrumentationRunnerArguments.class=com.sysadmindoc.callshield.platform.TargetSdkBehaviorSmokeTest
 ./gradlew verifyPipelineTests # Cloudflare Worker (node) + data-pipeline and translation checks (python)
 ```
 
-The suite is **2054 total JVM unit tests**, run with Robolectric wherever a screen, a service or the database is involved.
+The suite is **2055 total JVM unit tests**, run with Robolectric wherever a screen, a service or the database is involved.
 
 Two GitHub workflows run without building the app. **Validation** runs the Worker and
 pipeline suites on every push except report-only ones (`run-pipeline-tests.ps1 -CorrectnessOnly`),
@@ -634,7 +634,7 @@ language in [issue #7](https://github.com/SysAdminDoc/CallShield/issues/7).
 | Community API | Cloudflare Workers |
 | URL Safety | Local spam-domain data, with optional PhishTank and OpenPhish |
 | Verification | Local Gradle, lint, and release-artifact checks |
-| Tests | 2054 JVM unit tests (JUnit) |
+| Tests | 2055 JVM unit tests (JUnit) |
 | Strings | 1794 string resources and 49 plural groups (translation-ready) |
 | Accessibility | 100+ content descriptions, 48dp touch targets |
 | Min SDK | 29 (Android 10) |

app/src/main/java/com/sysadmindoc/callshield/service/RcsNotificationListener.kt

@@ -326,12 +326,7 @@ class RcsNotificationListener : NotificationListenerService() {
             // Best-effort, as in SmsReceiver. This scope has no exception
             // handler, so a throw here would take the whole app down.
             try {
-                val malicious =
-                    UrlSafetyChecker.checkSmsBody(
-                        body,
-                        stripQuery = stripQuery,
-                        allowRemoteLookup = allowRemoteLookup,
-                    )
+                val malicious = urlCheck(body, stripQuery, allowRemoteLookup)
                 if (malicious.isNotEmpty()) {
                     val threats = urlThreatLabels(applicationContext, malicious)
                     if (source.category == NotificationScreeningCategory.RCS && filterAsciiDigits(sender).length >= 7) {
@@ -411,6 +406,10 @@ class RcsNotificationListener : NotificationListenerService() {
     }
 
     companion object {
+        /** The link check behind the URL warning. Tests replace it to make it throw. */
+        internal var urlCheck: suspend (body: String, stripQuery: Boolean, allowRemoteLookup: Boolean) -> List<UrlSafetyChecker.UrlCheckResult> =
+            { body, stripQuery, allowRemoteLookup -> UrlSafetyChecker.checkSmsBody(body, stripQuery, allowRemoteLookup) }
+
         /**
          * Logs a message this listener flagged. The SMS receiver has usually
          * logged an SMS already, and [SpamRepository.logFlaggedText] logs only

app/src/test/java/com/sysadmindoc/callshield/service/RcsNotificationListenerTest.kt

@@ -30,6 +30,8 @@ import org.robolectric.Robolectric
 import org.robolectric.RobolectricTestRunner
 import org.robolectric.Shadows.shadowOf
 import org.robolectric.annotation.Config
+import java.util.concurrent.CopyOnWriteArrayList
+import java.util.concurrent.CountDownLatch
 
 /** Texts that only reach CallShield as a messaging app's notification, as RCS chats do. */
 @RunWith(RobolectricTestRunner::class)
@@ -81,6 +83,28 @@ class RcsNotificationListenerTest {
         }
     }
 
+    @Test
+    fun `a link check that throws doesn't take the app down`() {
+        val crashes = CopyOnWriteArrayList<Throwable>()
+        val checked = CountDownLatch(1)
+        val previousHandler = Thread.getDefaultUncaughtExceptionHandler()
+        val realCheck = RcsNotificationListener.urlCheck
+        Thread.setDefaultUncaughtExceptionHandler { _, e -> crashes += e }
+        RcsNotificationListener.urlCheck = { _, _, _ ->
+            checked.countDown()
+            error("threat feed unreadable")
+        }
+        try {
+            postUntil(chatNotification("Here are the notes from today https://example.com/notes", sender = "Dana")) { checked.count == 0L }
+            // An escaped throw reaches the handler right after the check, on the listener's thread.
+            Thread.sleep(500L)
+            assertEquals(emptyList<Throwable>(), crashes.toList())
+        } finally {
+            RcsNotificationListener.urlCheck = realCheck
+            Thread.setDefaultUncaughtExceptionHandler(previousHandler)
+        }
+    }
+
     @Test
     fun `a meeting app's background Connected notification doesn't start meeting mode, its call does`() {
         MeetingModeRegistry.clear()