amitshekhariitbhu / Android-Debug-Database

A library for debugging android databases and shared preferences - Make Debugging Great Again
https://outcomeschool.com
Apache License 2.0
8.39k stars 872 forks source link

This library is being used by apps in production #179

Open nyancrimew opened 4 years ago

nyancrimew commented 4 years ago

I found out about this library in a sad way. I found tons of devices with it exposed on :8080 on shodan, and tracked down a couple of (big) apps using it in production. (read here: https://deletescape.ch/posts/how-to-leak-all-user-data/)

My suggestion here would be to actually prevent the library from working at all in non-debug builds (potentially adding an override flag for locally debugging prod builds), so this cannot happen by accident. I know that the docs in this repo make it very clear to use it only on debug builds and how to achieve that, and I put no blame on you, but I think it is important to try and prevent this from happening again in every way possible.

amitshekhariitbhu commented 4 years ago

Hey, @deletescape Yes, It is clearly mentioned in the document. Use debugImplementation so that it will only compile in your debug build and not in your release build. Yes, of course, we can add the extra flag to prevent this.