Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Vulnerability]: Security scanner find vulnerability in broadcast receiver for share plus plugin #1608

Closed
charafau opened this issue Mar 8, 2023 · 1 comment · Fixed by #1613
Assignees
Labels
bug Something isn't working triage

Comments

@charafau
Copy link
Contributor

charafau commented Mar 8, 2023

Platform

Android

Plugin

Share plus

Version

6.0.1

Flutter SDK

3.7.5

Steps to reproduce

Just install plugin, it will get report from scanner about vulnerability.

Scanner reports vulnerability:

Findings: Broadcast Receiver (dev.fluttercommunity.plus.share.SharePlusPendingIntent) is not Protected.
Severity: high
Description:

[android:exported=true] A Broadcast Receiver is found to be
 shared with other apps on the device therefore leaving it 
accessible to any other application on the device.

Code Sample

No response

Logs

not needed for this ticket

Flutter Doctor

[✓] Flutter (Channel stable, 3.7.5, on macOS 13.2.1 22D68 darwin-arm64, locale en-GB)
    • Flutter version 3.7.5 on channel stable 
    • Upstream repository https://github.com/flutter/flutter.git
    • Framework revision c07f788888 (2 weeks ago), 2023-02-22 17:52:33 -0600
    • Engine revision 0f359063c4
    • Dart version 2.19.2
    • DevTools version 2.20.1

[✓] Android toolchain - develop for Android devices (Android SDK version 31.0.0)
    • Platform android-33, build-tools 31.0.0
    • Java binary at: /Applications/Android Studio.app/Contents/jbr/Contents/Home/bin/java
    • Java version OpenJDK Runtime Environment (build 11.0.15+0-b2043.56-8887301)
    • All Android licenses accepted.


### Checklist before submitting a bug

- [X] I Google'd a solution and I couldn't find it
- [X] I searched on StackOverflow for a solution and I couldn't find it
- [X] I read the README.md file of the plugin
- [X] I'm using the latest version of the plugin
- [X] All dependencies are up to date with `flutter pub upgrade`
- [X] I did a `flutter clean`
- [X] I tried running the example project
@charafau charafau added bug Something isn't working triage labels Mar 8, 2023
@mhadaily
Copy link
Member

mhadaily commented Mar 8, 2023

Thanks for reporting, we will take this internally to discuss solutions.

Meanwhile, I appreciate anyone's help or contribution on this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working triage
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants