talsec / Free-RASP-Flutter

Flutter library for improving app security and threat monitoring on Android and iOS mobile devices.
https://github.com/talsec/Free-RASP-Community
MIT License
194 stars 22 forks source link

[BUILD FAILED] when trying build appbundle with --obfuscate flag #31

Closed mifhai closed 2 years ago

mifhai commented 2 years ago
Screen Shot 2022-10-18 at 10 34 54

i have an error when trying to run flutter build appbundle --obfuscate --split-debug-info=./project_name/debug --no-shrink

talsec-app commented 2 years ago

Hello @mifhai , could you please provide more information about the issue? We couldn't reproduce it. There may be some culprit within the proguar-rules.pro, can you share that file with us? Thanks in advance, Talsec Team

mifhai commented 2 years ago

Thanks for the response and Sorry for the lack of information above.

sure this proguar-rules.pro in my project

Gson rules

Gson uses generic type information stored in a class file when working with fields. Proguard

removes such information by default, so configure it to keep all of it.

-keepattributes Signature

For using GSON @Expose annotation

-keepattributes Annotation

Gson specific classes

-dontwarn sun.misc.**

-keep class com.google.gson.stream.* { ; }

Prevent proguard from stripping interface information from TypeAdapter, TypeAdapterFactory,

JsonSerializer, JsonDeserializer instances (so they can be used in @JsonAdapter)

-keep class extends com.google.gson.TypeAdapter -keep class implements com.google.gson.TypeAdapterFactory -keep class implements com.google.gson.JsonSerializer -keep class implements com.google.gson.JsonDeserializer

Prevent R8 from leaving Data object members always null

-keepclassmembers,allowobfuscation class * { @com.google.gson.annotations.SerializedName ; }

freeRASP

-keepclasseswithmembernames,includedescriptorclasses class * { native; }

talsec-app commented 2 years ago

@mifhai Thank you, we will look into that.

talsec-app commented 2 years ago

Hello @mifhai , we have located the issue in our README (which we will update ASAP). The rule needs to be like this:

-keepclasseswithmembernames,includedescriptorclasses class * {
native *;
}

The asterisk (*) after 'native' should fix the issue.

talsec-app commented 2 years ago

Hello @mifhai , did the proposed solution work? Thank you.

Kind regards, Talsec team