paypal / android-checkout-sdk

Apache License 2.0
77 stars 38 forks source link

Dexguard Obfuscation issue with PYPL_FPTI fetchPayload #178

Closed fares-ben-chaabane closed 1 year ago

fares-ben-chaabane commented 1 year ago

Hello,

We are currently using Dexguard for security reason to obfuscate our code. With that we noticed that the PayPal checkout SDK is crashing when trying to : PLog.info(PEnums.LogType.FPTI, "startprogress") Since that method is calling PYPL_FPTI.getInstance().fetchPayload(eventType) Which leads to a crash since Dictionary is a nullable parameter and it will remain null when reading from the "FPTIDictionary.json" file is not possible :

 public PYPL_FPTI() {
        AssetManager am = config.getProviderContext().getAssets();
        try (InputStream input = am.open("FPTIDictionary.json")) {
            byte[] buffer = new byte[input.available()];
            input.read(buffer);
            input.close();

            // String-ify the script byte-array using BASE64 encoding !!!
            String content = new String(buffer);
            dictionary = new JSONObject(content);

        } catch (IOException | JSONException ex) {
            ex.printStackTrace();
        }
    }

So the

public JSONObject fetchPayload(String type) {
        try {
            return ((JSONObject) dictionary.get(type));
        } catch (JSONException e) {
            System.out.println(e);
        }
        return null;
    }

fail with a NullPointerException : Caused by: java.lang.NullPointerException: Attempt to invoke virtual method 'java.lang.Object org.json.JSONObject.get(java.lang.String)' on a null object reference

We are using the 0.8.5 version of the PayPal Checkout SDK

Can you please fill us with a fix for this as it's urgent.

fares-ben-chaabane commented 1 year ago

can we have an answer here?

saperi22 commented 1 year ago

@fares-ben-chaabane have you confirmed that the issue is related to Dexguard obfuscation i.e. no crash when Dexguard is disabled and crashes when Dexguard is enabled? Can you please confirm this for us?

If the crash is happening because of Dexguard obfuscation, the quickest solution would be for you to add a keep rule for the file on your end. We'll let you know when this is fixed on the SDK.

If you could provide all the details in the bug template, it would help us understand the bug better and eliminate other possibilities.

Smartphone (please complete the following information):

Android Version: [e.g. API 30]
Device: [e.g. Emulator or One Plus 9]
Browser [e.g. chrome, safari] <- only applicable for app switches or fallback situations
SDK Version [e.g. 0.1.0]
Package name of your app [e.g. com.example.my_app]
Client ID

Thanks for your time.

tdchow commented 1 year ago

Hi @fares-ben-chaabane - i'm closing this issue out due to inactivity. Feel free to comment here if you're still seeing the issue. Thanks!