Find Android components vulnerable to intent redirection

Finds an Intent that an Android component reads out of the extras of the Intent it was started with and then launches, for example startActivity(getIntent().getParcelableExtra("next")). The caller controls the nested Intent, and launching it runs with the application's own identity, so the caller can reach components the application never exported (CWE-20). The incoming Intent is Activity.getIntent() or the Intent parameter of onReceive, onNewIntent, onActivityResult, onStart, onStartCommand, onBind or onHandleIntent. Launching means passing it to startActivity, startService, bindService, sendBroadcast or one of their variants, or returning it with setResult. Not marked: relaunching the incoming Intent itself, a nested Intent given a fixed target with setClass, setClassName or setComponent, and a nested Intent carried as an extra of a new Intent. A nested Intent whose target is checked by hand is still marked, and whether the component is exported is not checked. Test sources are not searched.