search

OneSignal / OneSignal-Xamarin-SDK

OneSignal is a free push notification service for mobile apps. This plugin makes it easy to integrate your Xamarin app with OneSignal. https://onesignal.com
Other
105 stars 50 forks source link

GooglePlay Dev alert: Your app contains exposed Google Cloud Platform (GCP) API keys #186

Closed felipechavez closed 4 years ago

felipechavez commented 4 years ago

Description:

Hi, we have an alert from Google Play when we uploading the app to the store:

Security alert

Your app contains exposed Google Cloud Platform (GCP) API keys. Please see this Google Help Center article for details

Vulnerable locations:

com.onesignal.PushRegistratorFCM-> getApiKey It affects version 45 of the APK.

Environment

Xamarin SDK Version: 3.7.3 We add the SDK in all projects related. (Shared, Android and iOS)

Steps to Reproduce Issue:

  1. Add version 3.7.3 of the Xamarin SDK to your project
  2. Initialize the SDK with your App ID
  3. Upload your app in GooglePlay Services
  4. Get the warning:

Security alert

Your app contains exposed Google Cloud Platform (GCP) API keys. Please see this Google Help Center article for details

Vulnerable locations:

com.onesignal.PushRegistratorFCM-> getApiKey It affects version 45 of the APK.

Anything else:

The same problem like the issue below: https://github.com/OneSignal/OneSignal-Unity-SDK/issues/278

ouma commented 4 years ago

Same here

serdarrah1 commented 4 years ago

Same error

EmilAlipiev commented 4 years ago

It seems like that they updated their android package but as usual xamarin is neglected again :(

serdarrah1 commented 4 years ago

I think problem is about firebase json config file or another static file(including google cloud api key). I removed firebase json config on my app and re-send to google, and then it's published.

mikechoch commented 4 years ago

A fix for this is coming soon! We have to update the native SDKs before updating all the wrapper SDKs! In the next coming weeks be on the look out for 3.8.0!

sergiobonillamorales commented 4 years ago

Hi, I'm uploading an update for our app to the Google Play Store and it is rejecting the update due this problem. I've updated the version of OneSignal from 3.7.3 to 3.8.0 and the problem still persists.

@mikechoch do you have any idea what it could be? I saw the code for this fix in the Android SDK and everything looks fine.

jkasten2 commented 4 years ago

@sergiobonillamorales It is only a warning so I don't believe it should cause a reject from Google. It is also a false positive so it is still safe to do so. However of course updating to 3.8.0+ of this library should completely fix the warning.

Make sure you have updated all OneSignal packages in all your projects. Specifically double check your Android target.

Lastly I recommend updating to the latest 3.10.0 as there are other fixes you would be missing out on. https://github.com/OneSignal/OneSignal-Xamarin-SDK/releases