shorebirdtech / shorebird

Code Push for Flutter and other tools for Flutter businesses.
https://shorebird.dev
Other
2.36k stars 143 forks source link

patch version and freeRasp inconvenient #993

Closed JgomesAT closed 1 year ago

JgomesAT commented 1 year ago

I create a patch version of my app and I can see the changes, but I can see the pop-up in my case(its like that's how I configure) because the freeRasp detect and violation of AppIntegrity

this is my code for check that:

ThreatCallback(
      onAppIntegrity: () => DialogUtils.showAlertDialog(
        dismissible: false,
        context: ContextManager.getInstance().currentViewModel!.context,
        title: "App integrity vulnerada, l'app no puede continuar por motivos de segurida",
        negativeButtonTitle: "Sortir de l'app",
        negativeButtonListener: () => SystemNavigator.pop(),
      ),

Doc of Talsec: https://github.com/talsec/Free-RASP-Community/wiki/Threat-detection#app-tampering-detection

eseidel commented 1 year ago

We would have to see what checks its performing. But yes, Shorebird helps your app boot from code outside of the app bundle. I'm not entirely sure how it's detecting that (would have to learn more about what Free-RASP is doing). So I'm not sure there is anything for us to fix here.

eseidel commented 1 year ago

I think you'd have to ask the TalSec folks what they expect the behavior to be. We'd be happy to work with them over time to make something that their tool wont warn about.

JgomesAT commented 1 year ago

Thanks by your help, I found the problem, it was the signature configured in freeRasp , I only put the release signature, in my proves of Shorebird I was using the dev