Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

android - Fix improper access permitions #261

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

seamlink-aalves
Copy link

@seamlink-aalves seamlink-aalves commented Feb 2, 2024

We had an external audit to our App which uses this plugin.

During the audit, it was found that the activity "com.adobe.phonegap.push.BackgroundHandlerActivity" is
configured with the following permissions: com.seamlink.gatewaybox.chporto.permission.BackgroundHandlerActivity [android:exported=true] and that this allows other applications running on the device to access and interact with this Activity. This can become serious if this Activity contains sensitive features or information.

It was recomended that we configure the permissions protection level to "signature", because the Activity should only be accessed by applications with the same signature or certificate.

Description

Changed the protection level of BackgroundHandlerActivity to only be used by applications with the same signature or certificate.

I've tested this change and could receive notification with the app running, in the background or not running at all.

Related Issue

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have read the CONTRIBUTING document.
  • I have added tests to cover my changes.
  • All new and existing tests passed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant