[Bug]: Remote Webview debugging is enabled.

rakeshv1108 commented 1 year ago

What happened?

How can this Webview debugging mode be turned off?

I've included my release apk build in the Mobsf testing procedure to look for security flaws. Additionally, I received one serious problem from the Mobsf report for your package library. The screenshot for that report is attached. Please take action to fix the security problem.

Screen Shot 2023-02-15 at 12 07 09 PM

Thank you.

Steps to reproduce?

1. Create release android build apk.
2. Set up the Mobsf security checkup tool.
3. Analyse that same apk through that Mobsf tool.

What did you expect to happen?

I want to disable or remove that debugging line from the npm package code.

React Native OneSignal SDK version

Release 4.5.0

Which platform(s) are affected?

[ ] iOS
[X] Android

Relevant log output

No response

Code of Conduct

[X] I agree to follow this project's Code of Conduct

mlblount45 commented 1 year ago

Has this issue been added to the project road map? any approximation date on when this will be addressed?

samu-gataca commented 1 year ago

Any new about this?

emawby commented 1 year ago

I apologize we do not have news yet, but we appreciate the bump! We will investigate

maxi-sante commented 1 year ago

Any new?

Redn4s commented 11 months ago

A pentest of our app revealed that Remote WebView debugging is activated. This was specifically found in OneSignal: com/onesignal/WebViewManager.java. We're use v4.5.1 of react-native-onesignal.

Any news about the issue yet?

tair-rhyme commented 8 months ago

seems like that is false positive, because of this, if you do not set logLevel to debug and higher it should be OK

manish-chimera commented 5 months ago

I am having similar issue with Onesignal Android SDK with version 5.1.7. how can we disable Remote WEBview debugging?

OneSignal / react-native-onesignal