nic-delhi / AarogyaSetu_Android

Aarogya Setu Android app native code
https://www.aarogyasetu.gov.in/
Other
2.88k stars 1.85k forks source link

Push message from server can cause app to silently upload stored bluetooth/location data #535

Open doug-leith opened 3 years ago

doug-leith commented 3 years ago

Function pushDataToServer() function in FcmMessagingService.java implements functionality whereby receipt of an appropriate push message from the server causes the app to respond by uploading the stored bluetooth/location data to the server. This happens silently, without notifying the user or asking for their consent. We recommend that this functionality be disabled/removed as a matter of urgency.