talsec / Free-RASP-ReactNative

React Native plugin for improving app security and threat monitoring on Android and iOS mobile devices.
https://github.com/talsec/Free-RASP-Community
MIT License
82 stars 10 forks source link

breaks android app #79

Open jliukai opened 4 weeks ago

jliukai commented 4 weeks ago

Describe the bug apk file is fine. aab file crashes the app.

To Reproduce Setup

  1. I ran in metro and via apk file, runs fine.
  2. then built in aab file, upload for internal testing, crashes app

Expected behavior not crash, app the load fine, since no code was ran.

Please complete the following information:

Additional context

my logcat output

08-14 22:11:16.358  1467  1701 I ActivityManager: Start proc 5133:com.myapp1.main/u0a315 for top-activity {com.myapp1.main/com.mobile.MainActivity}
08-14 22:11:16.369  5133  5133 I com.myapp1.main: Using CollectorTypeCMC GC.
08-14 22:11:16.373  5133  5133 E com.myapp1.main: Not starting debugger since process cannot load the jdwp agent.
08-14 22:11:16.392  5133  5133 W ziparchive: Unable to open '/data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.arm64_v8a.dm': No such file or directory
08-14 22:11:16.392  5133  5133 W ziparchive: Unable to open '/data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.arm64_v8a.dm': No such file or directory
08-14 22:11:16.392  5133  5133 W com.myapp1.main: Entry not found
08-14 22:11:16.393  5133  5133 W ziparchive: Unable to open '/data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.en.dm': No such file or directory
08-14 22:11:16.393  5133  5133 W ziparchive: Unable to open '/data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.en.dm': No such file or directory
08-14 22:11:16.393  5133  5133 W com.myapp1.main: Entry not found
08-14 22:11:16.393  5133  5133 W ziparchive: Unable to open '/data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.xxhdpi.dm': No such file or directory
08-14 22:11:16.393  5133  5133 W ziparchive: Unable to open '/data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.xxhdpi.dm': No such file or directory
08-14 22:11:16.394  5133  5133 W com.myapp1.main: Entry not found
08-14 22:11:16.395  5133  5133 D nativeloader: Configuring clns-4 for other apk /data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/base.apk:/data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.arm64_v8a.apk:/data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.en.apk:/data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.xxhdpi.apk. target_sdk_version=34, uses_libraries=, library_path=/data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/lib/arm64:/data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/base.apk!/lib/arm64-v8a:/data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.arm64_v8a.apk!/lib/arm64-v8a:/data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.en.apk!/lib/arm64-v8a:/data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.xxhdpi.apk!/lib/arm64-v8a, permitted_pa
08-14 22:11:16.402  5133  5133 V GraphicsEnvironment: com.myapp1.main is not listed in per-application setting
08-14 22:11:16.429  5133  5133 E AndroidRuntime: Process: com.myapp1.main, PID: 5133
08-14 22:11:16.447  1467  4092 I ActivityManager: Process com.myapp1.main (pid 5133) has died: fg  TOP
08-14 22:11:18.545  7586  7586 E ActivityThread: Package [com.myapp1.main] reported as REPLACED, but missing application info. Assuming REMOVED.
08-14 22:11:18.549  7586  7586 E ActivityThread: Package [com.myapp1.main] reported as REPLACED, but missing application info. Assuming REMOVED.
08-14 22:11:31.383  1467  1700 I ActivityManager: Skip zero pid ANR, process=com.myapp1.main
08-14 22:11:41.039  3061  3077 W .apps.wellbeing: ApkAssets: Deleting an ApkAssets object '<empty> and /data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/base.apk' with 1 weak references
08-14 22:11:41.039  3061  3077 W .apps.wellbeing: ApkAssets: Deleting an ApkAssets object '<empty> and /data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.arm64_v8a.apk' with 1 weak references
08-14 22:11:41.039  3061  3077 W .apps.wellbeing: ApkAssets: Deleting an ApkAssets object '<empty> and /data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.en.apk' with 1 weak references
08-14 22:11:41.040  3061  3077 W .apps.wellbeing: ApkAssets: Deleting an ApkAssets object '<empty> and /data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.xxhdpi.apk' with 1 weak references
08-14 22:13:01.760 15502 15514 W gle.android.gms: ApkAssets: Deleting an ApkAssets object '<empty> and /data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/base.apk' with 1 weak references
08-14 22:13:01.761 15502 15514 W gle.android.gms: ApkAssets: Deleting an ApkAssets object '<empty> and /data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.arm64_v8a.apk' with 1 weak references
08-14 22:13:01.761 15502 15514 W gle.android.gms: ApkAssets: Deleting an ApkAssets object '<empty> and /data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.en.apk' with 1 weak references
08-14 22:13:01.761 15502 15514 W gle.android.gms: ApkAssets: Deleting an ApkAssets object '<empty> and /data/app/~~lzSx6NlBPFZt9NdBDCwfhQ==/com.myapp1.main-AzmnOeOIaTnNmSA74md2QA==/split_config.xxhdpi.apk' with 1 weak references
08-14 22:17:30.872 14636 14636 E ActivityThread: Package [com.myapp1.main] reported as REPLACED, but missing application info. Assuming REMOVED.
tompsota commented 4 weeks ago

Hello, @jliukai,

The error logs do not indicate any reference to freeRASP.

The log reveals multiple warnings about missing configuration files (split_config.*.dm) and the application not being able to load certain resources. Specifically, the process cannot start the debugger due to the inability to load the JDWP agent, and the app repeatedly fails to find required entries. Subsequently, the app crashes with an AndroidRuntime error, and the system reports that the package is "REPLACED" but assumes it has been "REMOVED" due to missing application information.

Anyway, I don't see any way how freeRASP could affect your build as you don't even use it.

Best, Tomas from Talsec

jliukai commented 4 weeks ago

yeah. this bug is really confusing.

When i "npm uninstall freerasp-react-native" , and ./gradlew clean, create an aab file, => app runs fine.

then I "npm i freerasp-react-native", and no other changes in code (ie. not touched: androidmanifest.xml, build gradles, or react native components), create an aab file => app crashes. i get the errors in logcat.

Given i have a RN 0.72.5 https://github.com/talsec/Free-RASP-ReactNative and my minSdkVersion = 24, this implies android works out of the box.

is there some updated configuration required for android? I'm trying to compare configs in https://github.com/talsec/Free-RASP-Android and in https://github.com/talsec/Free-RASP-ReactNative for android.

tompsota commented 2 weeks ago

Hi @jliukai,

Just the minSdkVersion = 23 is required for Android.

I reproduced the issue, it seems like just newer versions of RN are affected (the example in this repo uses RN 0.70.6 and works just fine).

Trying to fix this now.

Best, Tomas from Talsec

tompsota commented 1 week ago

Hi @jliukai,

The issue I ran into is probably not related to yours, as I reproduced it only in RN 0.75 (although it looked very similar). That one will be fixed in v3.8.2.

However, I ran into this SO question which may be useful for you: https://stackoverflow.com/a/77280632 - tldr, integrate freeRASP and the issue may be gone 😉

Best, Tomas from Talsec