"Permission Denied" pop-up even after permissions were given

[makew0rld]

Description

Even after the Starling Capture app has permissions, it still says "permission denied" when clicking the plus button. This means no claims can be made with the app.

• This appeared in v1.9.2, but only in the QA build, not the debug one
  • The QA build had this issue on both the Exodus 1s and Samsung
• This occurs in v1.9.3, specifically app-starling-prodStarlingIntegrity.apk was tested
• This occurs for both Exodus 1s and another Android device tested (Samsung Galaxy A50)

Steps to Reproduce

1. Install app-starling-prodStarlingIntegrity.apk from v1.9.3 on the phone: download link
2. Open the app and click the plus icon in the bottom right
3. Allow all the permission pop-ups
4. Observe the "permission denied" pop-up
5. Try and click the plus icon again, and observe how the "permission denied" shows up every time

Expected Behavior

The "permission denied" pop-up no longer shows up after permissions have been allowed.

Environment

• HTC Exodus 1s on Android 8.1.0
• Samsung Galaxy A50 (SM-A505W) on Android 11

[bafu]

Testing results of the 4 v1.9.2 APKs

1. app-master-qa.apk: Fail
   1. See the "Permission Denied" dialog
   2. asked 3 permissions: camera, location, microphone
2. app-master-debug.apk: Success
   1. asked 4 permissions: camera, location, microphone, storage
3. app-starling-qa.apk: Fail
   1. The same as app-master-qa
4. app-starling-debug.apk: Success
   1. The same as app-master-debug

Testing results of the v1.9.3 APKs

1. app-master-qa.apk: Fail
   1. See the "Permission Denied" dialog (the same as v1.9.2)
2. app-master-debug.apk: Success
3. app-starling-legacyStarlingIntegrity.apk: Fail
   1. See the "Permission Denied" dialog (the same as app-master-qa.apk)
4. app-starling-stgStarlingIntegrity.apk: Fail
   1. See the "Permission Denied" dialog (the same as app-master-qa.apk)
5. app-starling-prodStarlingIntegrity.apk: Fail
   1. See the "Permission Denied" dialog (the same as app-master-qa.apk)

[bafu]

Comparing the difference between the v1.9.3/app-master-{qa, debug}.apk

Extract APKs by apktool

$ apktool d -o app-master-qa app-master-qa.apk
$ apktool d -o app-master-debug app-master-debug.apk

Compare the manifests

$ diff -Naru app-master-qa/AndroidManifest.xml app-master-debug/AndroidManifest.xml
--- app-master-qa/AndroidManifest.xml   2023-01-27 18:55:36
+++ app-master-debug/AndroidManifest.xml        2023-01-27 18:56:05
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8" standalone="no"?><manifest xmlns:android="http://schemas.android.com/apk/res/android" android:compileSdkVersion="30" android:compileSdkVersionCodename="11" package="io.numbersprotocol.starlingcapture.qa" platformBuildVersionCode="30" platformBuildVersionName="11">
+<?xml version="1.0" encoding="utf-8" standalone="no"?><manifest xmlns:android="http://schemas.android.com/apk/res/android" android:compileSdkVersion="30" android:compileSdkVersionCodename="11" package="io.numbersprotocol.starlingcapture.debug" platformBuildVersionCode="30" platformBuildVersionName="11">
     <uses-feature android:name="android.hardware.camera" android:required="true"/>
     <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
@@ -19,6 +19,8 @@
     <uses-feature android:name="android.hardware.camera.autofocus" android:required="false"/>
     <uses-feature android:name="android.hardware.camera.front" android:required="false"/>
     <uses-feature android:name="android.hardware.microphone" android:required="false"/>
+    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
+    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
     <uses-permission android:name="android.permission.WAKE_LOCK"/>
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
     <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
@@ -30,7 +32,7 @@
             </intent-filter>
         </activity>
         <service android:exported="false" android:name="io.numbersprotocol.starlingcapture.source.canon.CanonCameraControlService"/>
-        <provider android:authorities="io.numbersprotocol.starlingcapture.qa.provider" android:exported="false" android:grantUriPermissions="true" android:name="androidx.core.content.FileProvider">
+        <provider android:authorities="io.numbersprotocol.starlingcapture.debug.provider" android:exported="false" android:grantUriPermissions="true" android:name="androidx.core.content.FileProvider">
             <meta-data android:name="android.support.FILE_PROVIDER_PATHS" android:resource="@xml/file_paths"/>
         </provider>
         <activity android:name="com.htc.htcwalletsdk.Act.UITestAct" android:screenOrientation="portrait"/>
@@ -43,8 +45,24 @@
         <activity android:name="com.htc.htcwalletsdk.Act.UISocialRestoreAct" android:screenOrientation="portrait" android:theme="@style/NoActionBar"/>
         <activity android:name="com.htc.htcwalletsdk.Act.UIVerificationCodeAct" android:screenOrientation="portrait" android:theme="@style/NoActionBar"/>
         <activity android:name="com.htc.htcwalletsdk.Act.UIErrorDialogAct" android:screenOrientation="portrait" android:theme="@style/AlertDialogThemeEx"/>
+        <service android:exported="false" android:name="leakcanary.internal.HeapAnalyzerService"/>
+        <provider android:authorities="com.squareup.leakcanary.fileprovider.io.numbersprotocol.starlingcapture.debug" android:exported="false" android:grantUriPermissions="true" android:name="leakcanary.internal.LeakCanaryFileProvider">
+            <meta-data android:name="android.support.FILE_PROVIDER_PATHS" android:resource="@xml/leak_canary_file_paths"/>
+        </provider>
+        <activity android:icon="@mipmap/leak_canary_icon" android:label="@string/leak_canary_display_activity_label" android:name="leakcanary.internal.activity.LeakActivity" android:taskAffinity="com.squareup.leakcanary.io.numbersprotocol.starlingcapture.debug" android:theme="@style/leak_canary_LeakCanary.Base"/>
+        <activity-alias android:banner="@drawable/leak_canary_tv_icon" android:enabled="@bool/leak_canary_add_launcher_icon" android:icon="@mipmap/leak_canary_icon" android:label="@string/leak_canary_display_activity_label" android:name="leakcanary.internal.activity.LeakLauncherActivity" android:targetActivity="leakcanary.internal.activity.LeakActivity" android:taskAffinity="com.squareup.leakcanary.io.numbersprotocol.starlingcapture.debug" android:theme="@style/leak_canary_LeakCanary.Base">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN"/>
+                <category android:name="android.intent.category.LAUNCHER"/>
+                <category android:name="android.intent.category.LEANBACK_LAUNCHER"/>
+            </intent-filter>
+        </activity-alias>
+        <activity android:excludeFromRecents="true" android:icon="@mipmap/leak_canary_icon" android:label="@string/leak_canary_storage_permission_activity_label" android:name="leakcanary.internal.RequestStoragePermissionActivity" android:taskAffinity="com.squareup.leakcanary.io.numbersprotocol.starlingcapture.debug" android:theme="@style/leak_canary_Theme.Transparent"/>
+        <receiver android:name="leakcanary.internal.NotificationReceiver"/>
+        <provider android:authorities="io.numbersprotocol.starlingcapture.debug.leakcanary-installer" android:enabled="@bool/leak_canary_watcher_auto_install" android:exported="false" android:name="leakcanary.internal.AppWatcherInstaller$MainProcess"/>
+        <provider android:authorities="io.numbersprotocol.starlingcapture.debug.plumber-installer" android:enabled="@bool/leak_canary_plumber_auto_install" android:exported="false" android:name="leakcanary.internal.PlumberInstaller"/>
         <activity android:name="com.karumi.dexter.DexterActivity" android:theme="@style/Dexter.Internal.Theme.Transparent"/>
-        <provider android:authorities="io.numbersprotocol.starlingcapture.qa.workmanager-init" android:directBootAware="false" android:exported="false" android:multiprocess="true" android:name="androidx.work.impl.WorkManagerInitializer"/>
+        <provider android:authorities="io.numbersprotocol.starlingcapture.debug.workmanager-init" android:directBootAware="false" android:exported="false" android:multiprocess="true" android:name="androidx.work.impl.WorkManagerInitializer"/>
         <service android:directBootAware="false" android:enabled="@bool/enable_system_alarm_service_default" android:exported="false" android:name="androidx.work.impl.background.systemalarm.SystemAlarmService"/>
         <service android:directBootAware="false" android:enabled="@bool/enable_system_job_service_default" android:exported="true" android:name="androidx.work.impl.background.systemjob.SystemJobService" android:permission="android.permission.BIND_JOB_SERVICE"/>
         <service android:directBootAware="false" android:enabled="@bool/enable_system_foreground_service_default" android:exported="false" android:name="androidx.work.impl.foreground.SystemForegroundService"/>

[bafu]

We cannot rebuild v1.9.1 app-master-qa for verification because the libproofmode is not available now.

My guess is

1. libproofmode introduced the storage access permissions, that's why v1.9.1 builds work without specifying storage access permission in main product flavor's manifest.
2. debug mode gives storage access permissions by default, that's why only the app-master-debug build works normally.

Solution: Specify storage access permissions in the main product flavor's manifest explicitly.