search

onaio / steps-app

WHO STEPS App
Apache License 2.0
2 stars 2 forks source link

Investigate the Bootstrap Activity #195

Closed bkimondiu closed 2 years ago

bkimondiu commented 2 years ago

The auditor shared the following:

(androidx.test.core.app.InstrumentationActivityInvoker$BootstrapActivity) is not Protected. 
[android:exported=true]

(androidx.test.core.app.InstrumentationActivityInvoker$EmptyActivity) is not Protected. 
[android:exported=true]

(androidx.test.core.app.InstrumentationActivityInvoker$EmptyFloatingActivity) is not Protected. 
[android:exported=true]

With the description that An Activity is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device.

owais-vd commented 2 years ago

All three activities have no security implications as they are all launchable instrumentation test activities and intentionally exported true by the library. A launchable activity must be exported as of Android 12.

cc: @bkimondiu @ukanga @ekigamba

ekigamba commented 2 years ago

@owais-vd Are these activities disabled in the release version? If not, can we disable them since we do not currently use instrumentation testing.

owais-vd commented 2 years ago

@owais-vd Are these activities disabled in the release version? If not, can we disable them since we do not currently use instrumentation testing.

now, these activities are disabled in release build.