MohGovIL / hamagen-react-native

Israel's Ministry of Health's COVID-19 Exposure Prevention App
https://health.gov.il/
MIT License
508 stars 153 forks source link

Explain android permissions & remove not needed permissions #282

Open emanuelb opened 3 years ago

emanuelb commented 3 years ago

From decompiled APK in latest release by running apktool d -s hamagen-v2.2.14.apk

    <uses-permission android:name="android.permission.INTERNET"/>
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
    <uses-permission android:name="android.permission.ACCESS_BACKGROUND_LOCATION"/>
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
    <uses-permission android:name="android.permission.VIBRATE"/>
    <uses-permission android:name="android.permission.BLUETOOTH_ADMIN"/>
    <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS"/>
    <uses-permission android:name="android.permission.BLUETOOTH"/>
    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
    <uses-permission android:name="android.permission.WAKE_LOCK"/>
    <uses-permission android:name="android.permission.ACTIVITY_RECOGNITION"/>
    <uses-permission android:name="android.permission.ACCESS_LOCATION_EXTRA_COMMANDS"/>
    <uses-permission android:name="com.google.android.gms.permission.ACTIVITY_RECOGNITION"/>
    <uses-permission android:name="android.permission.GET_TASKS"/>
    <uses-permission android:name="oppo.permission.OPPO_COMPONENT_SAFE"/>
    <uses-permission android:name="com.huawei.permission.external_app_settings.USE_COMPONENT"/>
    <uses-permission android:name="com.google.android.c2dm.permission.RECEIVE"/>
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>
    <uses-permission android:name="com.android.alarm.permission.SET_ALARM"/>
    <uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE"/>

    <uses-feature android:name="android.hardware.bluetooth_le" android:required="false"/>
    <uses-feature android:glEsVersion="0x00020000" android:required="true"/>
    <uses-feature android:name="android.hardware.location.gps" android:required="false"/>
    <uses-feature android:name="android.hardware.bluetooth" android:required="false"/>

From code: https://github.com/MohGovIL/hamagen-react-native/blob/4ff7b4815801abac19a8f5c71cf91a317d1e12b9/android/app/src/main/AndroidManifest.xml#L5-L17

see for example explanation of other apps: https://support.signal.org/hc/en-us/articles/360007062172-Signal-Permissions#android_permissions https://support.mozilla.org/en-US/kb/how-firefox-android-use-permissions-it-requests

Please explain all used permissions in the android app, why they are needed & for what usage, remove unused or not necessary permissions if exists.

for example the android.permission.GET_TASKS permission is not needed as it's deprecated from API level 21 which is currently the used api level for minimum sdk. https://developer.android.com/reference/android/Manifest.permission#GET_TASKS