cdricms/vnidrop
1
1
Fork 0
mirror of https://github.com/sudosylabs/vnidrop.git synced 2026-08-05 02:29:55 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden provider ACL, tickets, and local secrets

Browse Source 
Close high-severity findings from the security review: default-deny blob
gets for unmapped hashes, map collection members for ACL, fail closed on
unknown access modes, require vnd1 tickets only, redact tickets from events,
exclude Android app-data backups, and tighten secret-file creation.
This commit is contained in:
Hammed Abass
2026-07-13 18:41:43 +02:00
parent 98375f479a
commit e7fb0331b5
27 changed files with 461 additions and 283 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
androidApp/src/main/AndroidManifest.xml
View File

@@ -13,6 +13,8 @@
<application
android:allowBackup="true"
android:fullBackupContent="@xml/backup_rules"
android:dataExtractionRules="@xml/data_extraction_rules"
android:icon="@mipmap/ic_launcher"
android:label="@string/app_name"
android:roundIcon="@mipmap/ic_launcher_round"

5
androidApp/src/main/res/xml/backup_rules.xml Normal file
View File

@@ -0,0 +1,5 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Exclude core identity, tickets, history, and blob store from Auto Backup. -->
<full-backup-content>
<exclude domain="file" path="vnidrop"/>
</full-backup-content>

11
androidApp/src/main/res/xml/data_extraction_rules.xml Normal file
View File

@@ -0,0 +1,11 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Exclude core identity, tickets, history, and blob store from cloud backup
and device-to-device transfer. -->
<data-extraction-rules>
<cloud-backup>
<exclude domain="file" path="vnidrop"/>
</cloud-backup>
<device-transfer>
<exclude domain="file" path="vnidrop"/>
</device-transfer>
</data-extraction-rules>