Beyka / Android-TiffBitmapFactory

MIT License
133 stars 46 forks source link

android:allowBackup should be removed from this library #47

Open TWiStErRob opened 4 years ago

TWiStErRob commented 4 years ago

Only applications should define this attribute. They need to decide whether they want to allow users to backup their app, and if it's true, what to back up. Please remove this attribute so that it doesn't leak into applications: imagine if an app doesn't declare this attribute, but it uses your library. They'll have their allowBackup set to some value they didn't decide on.

In our case we were lucky that we defined the value and it conflicted yours, so we were alerted to the change.

> Task :app:processReleaseManifest FAILED
app/src/main/AndroidManifest.xml:11:9-36 Error:
        Attribute application@allowBackup value=(false) from AndroidManifest.xml:11:9-36
        is also present at [com.github.beyka:androidtiffbitmapfactory:0.9.8.7] AndroidManifest.xml:12:9-35 value=(true).
        Suggestion: add 'tools:replace="android:allowBackup"' to <application> element at AndroidManifest.xml:9:5-26:19 to override.

Note: we didn't even use this tiff library, we got it through a transitive dependency! We just added implementation("com.thirdparty:library:1.2.3") and it pulled in this tiff library:

+--- com.thirdparty:library:1.2.3
|    +--- ... lots of other dependencies
|    \--- com.github.beyka:androidtiffbitmapfactory:0.9.8.7

There's no easy workaround for this other than every single user of your library and every single user of any library that depends on yours having to be aware of this leaked allowBackup attribute and use tools:replace.