Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Question on permissions #133

Open
IzzySoft opened this issue Aug 2, 2024 · 3 comments
Open

Question on permissions #133

IzzySoft opened this issue Aug 2, 2024 · 3 comments

Comments

@IzzySoft
Copy link

IzzySoft commented Aug 2, 2024

The scanners at IzzyOnDroid just reported:

! repo/phone.vishnu.quotes_64.apk declares sensitive permission(s): android.permission.READ_EXTERNAL_STORAGE*
! repo/phone.vishnu.quotes_64.apk contains signature block blobs: 0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

The asterisk indicates the permission was granted implicitly – most likely due to WRITE_EXTERNAL_STORAGE. May I ask what the storage permissions are needed for? Your app requires at least Android 5.1, so I'd assume it would use the Storage Access Network (SAF) which would (with exception of a few locations like Downloads or media storage) not need any specific permissions.

As for DEPENDENCY_INFO_BLOCK, that can easily be avoided by a minor adjustment to your build.gradle:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs.
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles.
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains. More details can be found e.g. here: Ramping up security: additional APK checks are in place with the IzzyOnDroid repo.

Thanks in advance!

@VishnuSanal
Copy link
Owner

Hi Izzy, I'll check & update, thanks!

VishnuSanal added a commit that referenced this issue Aug 4, 2024
@VishnuSanal
Copy link
Owner

hi, I have fixed the dependency issue. and, about the permission issue -- um... I don't remember the implementation from the top of my head. + that would require further investigation & extensive testing. will it be okay if I update/fix it in the next release? thanks!

@IzzySoft
Copy link
Author

IzzySoft commented Aug 4, 2024

I have fixed the dependency issue

cool, thanks!

will it be okay if I update/fix it in the next release?

Sure – it's not THAT critical that it would kill little kittens, right? 😉 Thanks for addressing it!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants