search

invertase / notifee

⚛️ A feature rich notifications library for React Native.
https://notifee.app
Apache License 2.0
1.83k stars 219 forks source link

Setting exported to false in Notifee Core #1110

Open shubham-imoney opened 2 weeks ago

shubham-imoney commented 2 weeks ago

An audit of our application which uses the Notifee library showed that app.notifee.core.NotificationRecieverActivity has exported set to true with no permission in AndroidManifest.xml. If i override this activity in my app AndroidManifest.xmland set it's exported to false, would this create any issues given that I use the notifee.displayNotification, notifee.onForegroundEvent and notifee.onBackgroundEvent functions.

I'm not too familiar with Android development so any input would be appreciated.

mikehardy commented 2 weeks ago

https://developer.android.com/guide/topics/manifest/receiver-element#exported

I believe - though please test it - that if you set it to not exported / exported == false, the app will still receive system broadcasts. I believe the restriction is just that inter-app communication with the receiver is blocked.

The point of the receiver is to receive notifications from the network, processed by the system and system-delivered to the app, so I think setting it to false will work fine.

If you test that and things work well for you, then this is something we may be able to change here so it is false to start. I think our intended use cases are supported well enough with it false assuming it works when you test it

shubham-imoney commented 2 weeks ago

https://developer.android.com/guide/topics/manifest/receiver-element#exported

I believe - though please test it - that if you set it to not exported / exported == false, the app will still receive system broadcasts. I believe the restriction is just that inter-app communication with the receiver is blocked.

The point of the receiver is to receive notifications from the network, processed by the system and system-delivered to the app, so I think setting it to false will work fine.

If you test that and things work well for you, then this is something we may be able to change here so it is false to start. I think our intended use cases are supported well enough with it false assuming it works when you test it

Okay. I'll test and get back in a day or two