From bce35ef8653acde1e465e5f63fed0ba849bb9212 Mon Sep 17 00:00:00 2001 From: Hans-Christoph Steiner Date: Mon, 31 Dec 2018 21:14:18 +0100 Subject: [PATCH 1/7] remove unused methods in database code to make auditing easier These were flagged as potential vulnerabilities. --- .../java/org/fdroid/fdroid/data/AppProvider.java | 13 ------------- .../java/org/fdroid/fdroid/data/QueryBuilder.java | 4 ---- 2 files changed, 17 deletions(-) diff --git a/app/src/main/java/org/fdroid/fdroid/data/AppProvider.java b/app/src/main/java/org/fdroid/fdroid/data/AppProvider.java index 727aa9d81..6283ca3d2 100644 --- a/app/src/main/java/org/fdroid/fdroid/data/AppProvider.java +++ b/app/src/main/java/org/fdroid/fdroid/data/AppProvider.java @@ -692,19 +692,6 @@ public class AppProvider extends FDroidProvider { return new AppQuerySelection(selection, args).add(queryPackageName(packageName)); } - /** - * Same as {@link AppProvider#querySingle(String, long)} except it is used for the purpose - * of an UPDATE query rather than a SELECT query. This means that it must use a subquery to get - * the {@link Cols.Package#PACKAGE_ID} rather than the join which is already in place for that - * table. The reason is because UPDATE queries cannot include joins in SQLite. - */ - protected AppQuerySelection querySingleForUpdate(String packageName, long repoId) { - final String selection = Cols.PACKAGE_ID + " = (" + getPackageIdFromPackageNameQuery() + - ") AND " + Cols.REPO_ID + " = ? "; - final String[] args = {packageName, Long.toString(repoId)}; - return new AppQuerySelection(selection, args); - } - private AppQuerySelection queryExcludeSwap() { // fdroid_repo will have null fields if the LEFT JOIN didn't resolve, e.g. due to there // being no apks for the app in the result set. In that case, we can't tell if it is from diff --git a/app/src/main/java/org/fdroid/fdroid/data/QueryBuilder.java b/app/src/main/java/org/fdroid/fdroid/data/QueryBuilder.java index 3168783e1..d74e560d9 100644 --- a/app/src/main/java/org/fdroid/fdroid/data/QueryBuilder.java +++ b/app/src/main/java/org/fdroid/fdroid/data/QueryBuilder.java @@ -20,10 +20,6 @@ abstract class QueryBuilder { public abstract void addField(String field); - protected int fieldCount() { - return fields.size(); - } - public void addFields(String[] fields) { for (final String field : fields) { addField(field); From 71920f6082fc44da450379c04850d21164a30b01 Mon Sep 17 00:00:00 2001 From: Hans-Christoph Steiner Date: Mon, 31 Dec 2018 21:21:45 +0100 Subject: [PATCH 2/7] use Cols.ROW_ID/Cols._ID for all "rowid"/"_id" strings --- app/src/main/java/org/fdroid/fdroid/data/ApkProvider.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/src/main/java/org/fdroid/fdroid/data/ApkProvider.java b/app/src/main/java/org/fdroid/fdroid/data/ApkProvider.java index c8c41fc50..d89eb0a68 100644 --- a/app/src/main/java/org/fdroid/fdroid/data/ApkProvider.java +++ b/app/src/main/java/org/fdroid/fdroid/data/ApkProvider.java @@ -335,7 +335,7 @@ public class ApkProvider extends FDroidProvider { antiFeaturesRequested = true; addAntiFeatures(); } else if (field.equals(Cols._ID)) { - appendField("rowid", "apk", "_id"); + appendField(Cols.ROW_ID, "apk", Cols._ID); } else if (field.equals(Cols._COUNT)) { appendField("COUNT(*) AS " + Cols._COUNT); } else if (field.equals(Cols._COUNT_DISTINCT)) { From 178371bf545711a7d825bbd4497a47ab2c2af5be Mon Sep 17 00:00:00 2001 From: Hans-Christoph Steiner Date: Mon, 31 Dec 2018 21:36:23 +0100 Subject: [PATCH 3/7] fix typos in translations caught by lint --- app/src/main/res/values-es/strings.xml | 2 +- app/src/main/res/values-pt-rBR/strings.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/app/src/main/res/values-es/strings.xml b/app/src/main/res/values-es/strings.xml index 631968aa4..9b0223b6b 100644 --- a/app/src/main/res/values-es/strings.xml +++ b/app/src/main/res/values-es/strings.xml @@ -516,7 +516,7 @@ Descargar usando WiFi Descargar usando tus datos Usar siempre esta conexion cuando este disponible - Usar esta conexion unicamente cuando seleccione descargar + Usar esta conexion únicamente cuando seleccione descargar No descargar nada usando esta conexion Esta aplicación tiene una firma de seguridad débil Esta aplicación contiene una vulnerabilidad de seguridad conocida diff --git a/app/src/main/res/values-pt-rBR/strings.xml b/app/src/main/res/values-pt-rBR/strings.xml index 5628eb702..4b3e4c806 100644 --- a/app/src/main/res/values-pt-rBR/strings.xml +++ b/app/src/main/res/values-pt-rBR/strings.xml @@ -536,7 +536,7 @@ Repositórios permitidos para instalar/desinstalar aplicativos Todas as atualizações estão desativadas por causa das configurações de Dados/WiFi - Não é possível atualizar, o código fonte não está mais disponivel. + Não é possível atualizar, o código fonte não está mais disponível. Repositório de metadados podem incluir solicitações de envio para instalar ou desinstalar aplicativos Compartilhar aplicativos instalados From 77a4ad4cc917cf36a8eba1d8d222247982f7556b Mon Sep 17 00:00:00 2001 From: Hans-Christoph Steiner Date: Mon, 31 Dec 2018 21:38:33 +0100 Subject: [PATCH 4/7] set lint "Typos" to be an error to catch translation issues --- app/lint.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/app/lint.xml b/app/lint.xml index f38e22391..b0a42e9f7 100644 --- a/app/lint.xml +++ b/app/lint.xml @@ -23,6 +23,7 @@ + From cf5b9520fb88b5e4e941f7b4c87829fa95f54b38 Mon Sep 17 00:00:00 2001 From: Hans-Christoph Steiner Date: Mon, 31 Dec 2018 22:00:57 +0100 Subject: [PATCH 5/7] fix lint "Implied locale in date format" --- app/lint.xml | 1 + app/src/full/java/kellinwood/logging/AbstractLogger.java | 3 ++- app/src/full/java/kellinwood/zipio/ZipListingHelper.java | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/app/lint.xml b/app/lint.xml index b0a42e9f7..6dc64ef81 100644 --- a/app/lint.xml +++ b/app/lint.xml @@ -9,6 +9,7 @@ + diff --git a/app/src/full/java/kellinwood/logging/AbstractLogger.java b/app/src/full/java/kellinwood/logging/AbstractLogger.java index 6a33b46c5..c2c3e4e0c 100644 --- a/app/src/full/java/kellinwood/logging/AbstractLogger.java +++ b/app/src/full/java/kellinwood/logging/AbstractLogger.java @@ -18,12 +18,13 @@ package kellinwood.logging; import java.text.SimpleDateFormat; import java.util.Date; +import java.util.Locale; public abstract class AbstractLogger implements LoggerInterface { protected String category; - SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd hh:mm:ss"); + SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd hh:mm:ss", Locale.ENGLISH); public AbstractLogger(String category) { this.category = category; diff --git a/app/src/full/java/kellinwood/zipio/ZipListingHelper.java b/app/src/full/java/kellinwood/zipio/ZipListingHelper.java index 1f7c74956..41bde0ba7 100644 --- a/app/src/full/java/kellinwood/zipio/ZipListingHelper.java +++ b/app/src/full/java/kellinwood/zipio/ZipListingHelper.java @@ -28,7 +28,7 @@ import java.util.Locale; */ public class ZipListingHelper { - static DateFormat dateFormat = new SimpleDateFormat("MM-dd-yy HH:mm"); + static DateFormat dateFormat = new SimpleDateFormat("MM-dd-yy HH:mm", Locale.ENGLISH); public static void listHeader(LoggerInterface log) { log.debug(" Length Method Size Ratio Date Time CRC-32 Name"); From 09abc0734e85516475942761a3c4e090af214cf7 Mon Sep 17 00:00:00 2001 From: Hans-Christoph Steiner Date: Mon, 31 Dec 2018 22:13:32 +0100 Subject: [PATCH 6/7] format code in PRNGFixes --- .../org/fdroid/fdroid/compat/PRNGFixes.java | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/app/src/main/java/org/fdroid/fdroid/compat/PRNGFixes.java b/app/src/main/java/org/fdroid/fdroid/compat/PRNGFixes.java index 7dc71f525..b9a003e84 100644 --- a/app/src/main/java/org/fdroid/fdroid/compat/PRNGFixes.java +++ b/app/src/main/java/org/fdroid/fdroid/compat/PRNGFixes.java @@ -10,6 +10,7 @@ package org.fdroid.fdroid.compat; * freely, as long as the origin is not misrepresented. */ +import android.annotation.SuppressLint; import android.os.Build; import android.os.Process; import android.util.Log; @@ -31,18 +32,23 @@ import java.security.Security; /** * Fixes for the output of the default PRNG having low entropy. - * + *

* The fixes need to be applied via {@link #apply()} before any use of Java * Cryptography Architecture primitives. A good place to invoke them is in the * application's {@code onCreate}. + * + * @see Some SecureRandom Thoughts */ public final class PRNGFixes { private static final byte[] BUILD_FINGERPRINT_AND_DEVICE_SERIAL = - getBuildFingerprintAndDeviceSerial(); + getBuildFingerprintAndDeviceSerial(); - /** Hidden constructor to prevent instantiation. */ - private PRNGFixes() { } + /** + * Hidden constructor to prevent instantiation. + */ + private PRNGFixes() { + } /** * Applies all fixes. @@ -131,7 +137,7 @@ public final class PRNGFixes { rng2.getProvider().getClass())) { throw new SecurityException( "SecureRandom.getInstance(\"SHA1PRNG\") backed by wrong" - + " Provider: " + rng2.getProvider().getClass()); + + " Provider: " + rng2.getProvider().getClass()); } } @@ -146,7 +152,7 @@ public final class PRNGFixes { super("LinuxPRNG", 1.0, "A Linux-specific random number provider that uses" - + " /dev/urandom"); + + " /dev/urandom"); // Although /dev/urandom is not a SHA-1 PRNG, some apps // explicitly request a SHA1PRNG SecureRandom and we thus need to // prevent them from getting the default implementation whose output From 079cf2e903ce8eb57446663ba46cd4d6003ae4b2 Mon Sep 17 00:00:00 2001 From: Hans-Christoph Steiner Date: Mon, 31 Dec 2018 22:14:10 +0100 Subject: [PATCH 7/7] enable lint HardwareIds as error Keep PRNGFixes as it is since it is security sensitive, standardized code from Google. While F-Droid never wants to do anything with hardware IDs at all, this code uses the Build.SERIAL as a seed for the random number generator, so it is safe privacy-wise. --- app/lint.xml | 1 + app/src/main/java/org/fdroid/fdroid/compat/PRNGFixes.java | 1 + 2 files changed, 2 insertions(+) diff --git a/app/lint.xml b/app/lint.xml index 6dc64ef81..9b706ddf7 100644 --- a/app/lint.xml +++ b/app/lint.xml @@ -29,6 +29,7 @@ + diff --git a/app/src/main/java/org/fdroid/fdroid/compat/PRNGFixes.java b/app/src/main/java/org/fdroid/fdroid/compat/PRNGFixes.java index b9a003e84..a17770f8c 100644 --- a/app/src/main/java/org/fdroid/fdroid/compat/PRNGFixes.java +++ b/app/src/main/java/org/fdroid/fdroid/compat/PRNGFixes.java @@ -306,6 +306,7 @@ public final class PRNGFixes { } } + @SuppressLint("HardwareIds") private static byte[] getBuildFingerprintAndDeviceSerial() { StringBuilder result = new StringBuilder(); String fingerprint = Build.FINGERPRINT;