[device_info_plus] Release APK contains debug-enabled dependency (com.deviceinsight.commons.BuildConfig.DEBUG=true)

Offen
  • Stimmt etwas nicht?
#4,015 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
48/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
dart, flutter
Bereich
mobile, security

Rechercherichtung

Start by inspecting device_info_plus's Android build configuration and how it packages com.deviceinsight.commons.BuildConfig into release APKs; the issue does not name those files. Check whether the reported DEBUG value enables functionality or is simply generated metadata, then verify it in a release artifact. Done means confirming whether this is an expected false positive or identifying a production security concern for maintainers to address.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

question
What is your question?

During a penetration test, the Android application was reported as containing a debug-enabled dependency.

The finding points to:

com/deviceinsight/commons/BuildConfig.java

The security assessment indicates that debug-related configuration is included in the final production build. Production artifacts should not expose debugging functionality or debug-enabled configurations.

Reported classification:

CWE-919: Weaknesses in Mobile Applications
OWASP Mobile Top 10: M1 Improper Platform Usage
OWASP MASVS: MSTG-RESILIENCE-2
Could the maintainers please verify whether:

The library is intentionally shipping debug configuration in release artifacts.
Any debug-only functionality remains accessible in production builds.
The generated BuildConfig values are expected and pose no security risk.
The purpose of this issue is to understand whether the reported penetration test finding is a false positive or if there is a security concern that should be addressed.

device_info_plus: 11.1.1
Flutter: 3.41.6

Checklist before submitting a question
  • I searched issues in this repository and couldn't find such bug/problem
  • I Google'd a solution and I couldn't find it
  • I searched on StackOverflow for a solution and I couldn't find it
  • I read the README.md file of the plugin
  • I am using the latest version of the plugin
  • All dependencies are up to date with flutter pub upgrade
  • I did a flutter clean
  • I tried running the example project
Vorherrschende Sprache
Dart
Sterne
1.9k
Forks
1.3k
Ø Merge
1 Std. 7 Min.
Gemergte PRs (30 T.)
1

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus fluttercommunity/plus_plugins

Alle Issues in fluttercommunity/plus_plugins

Ähnliche Issues

Weitere Issues zu Dart

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.