phonegap / phonegap-plugin-push

Register and receive push notifications
MIT License
1.94k stars 1.91k forks source link

Security Error with android:exported=true #2938

Open nmanikiran opened 3 years ago

nmanikiran commented 3 years ago

Expected Behaviour

Set the android:exported=true => android:exported = false

Actual Behaviour

getting below security errors android:exported=true is set.

Severity: High

1:com.adobe.phonegap.push.FCMService 2:com.adobe.phonegap.push.PushInstanceIDListenerService 3:com.google.firebase.messaging.FirebaseMessagingService 4:com.google.firebase.iid.FirebaseInstanceIdService

Reproduce Scenario (including but not limited to)

After build the the .apk doing static analysing with MobSF

Steps to Reproduce

Platform and Version (eg. Android 5.0 or iOS 9.2.1)

Any

(Android) What device vendor (e.g. Samsung, HTC, Sony...)

Any

Cordova CLI version and cordova platform version

cordova --version                                    # e.g. 8.1.1
cordova platform version android                     # e.g. 4.1.1

Plugin version

cordova plugin version | grep phonegap-plugin-push   # e.g. 2.3.0

Logs taken while reproducing problem

Screenshot 2020-07-24 at 5 07 57 PM