[device_info_plus] Release APK contains debug-enabled dependency (com.deviceinsight.commons.BuildConfig.DEBUG=true)
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start by inspecting device_info_plus's Android build configuration and how it packages com.deviceinsight.commons.BuildConfig into release APKs; the issue does not name those files. Check whether the reported DEBUG value enables functionality or is simply generated metadata, then verify it in a release artifact. Done means confirming whether this is an expected false positive or identifying a production security concern for maintainers to address.
由索引模型根据 Issue 内容生成。
描述
What is your question?
During a penetration test, the Android application was reported as containing a debug-enabled dependency.
The finding points to:
com/deviceinsight/commons/BuildConfig.java
The security assessment indicates that debug-related configuration is included in the final production build. Production artifacts should not expose debugging functionality or debug-enabled configurations.
Reported classification:
CWE-919: Weaknesses in Mobile Applications
OWASP Mobile Top 10: M1 Improper Platform Usage
OWASP MASVS: MSTG-RESILIENCE-2
Could the maintainers please verify whether:
The library is intentionally shipping debug configuration in release artifacts.
Any debug-only functionality remains accessible in production builds.
The generated BuildConfig values are expected and pose no security risk.
The purpose of this issue is to understand whether the reported penetration test finding is a false positive or if there is a security concern that should be addressed.
device_info_plus: 11.1.1
Flutter: 3.41.6
Checklist before submitting a question
- I searched issues in this repository and couldn't find such bug/problem
- I Google'd a solution and I couldn't find it
- I searched on StackOverflow for a solution and I couldn't find it
- I read the README.md file of the plugin
- I am using the latest version of the plugin
- All dependencies are up to date with
flutter pub upgrade - I did a
flutter clean - I tried running the example project
- 主要语言
- Dart
- 星标
- 1.9k
- 派生
- 1.3k
- 平均合并
- 1 小时 7 分钟
- 30 天内合并 PR
- 1
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
fluttercommunity/plus_plugins 的其他 Issue
-
[Bug]: (share_plus) iOS drops the subject when sharing a uri可能已有人在做 @kaluli123123 于 34 天前认领。 未关闭bug triage
难度 2/5 1-3 小时 新手友好度 82/100
fluttercommunity/plus_plugins#3994 · 1 条评论 ·
维护者通常 1 天内回复
-
[Bug]: device_info_plus on Linux keeps the single quotes from os-release (Gentoo)可能已有人在做 @ChandraChaan 于 11 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 35/100
fluttercommunity/plus_plugins#4011 ·
维护者通常 1 天内回复
-
[Bug]: package_info_plus web throws StateError when the engine assetBase is relative可能已有人在做 @nmloc 于 20 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 35/100
fluttercommunity/plus_plugins#4005 ·
维护者通常 1 天内回复
-
[Bug]: share_plus decodes full-resolution images on the main thread when preparing iOS share previews可能已有人在做 @ananya-kaul 于 24 天前认领。 未关闭
难度 4/5 3-5 天 新手友好度 45/100
fluttercommunity/plus_plugins#4001 ·
维护者通常 1 天内回复
-
[Request]: network_info_plus: use ConnectivityManager for getWifiIP and getWifiGatewayIP from Android 7 (N), so ethernet works below Android 12可能已有人在做 @redge-munch 于 32 天前认领。 未关闭enhancement triage
难度 3/5 半天 新手友好度 22/100
fluttercommunity/plus_plugins#3998 ·
维护者通常 1 天内回复
查看 fluttercommunity/plus_plugins 的全部 Issue
相似的 Issue
-
enhancement
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 4 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
firebase/flutterfire#18918 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100
customerio/customerio-flutter#441 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 77/100
carp-dk/flutter-plugins#1312 ·
-
难度 2/5 1-3 小时 新手友好度 76/100
newrelic/newrelic-flutter-agent#256 ·
维护者通常 1 天内回复