cdricms/vnidrop
1
1
Fork 0
mirror of https://github.com/sudosylabs/vnidrop.git synced 2026-08-05 10:29:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden provider ACL, tickets, and local secrets

Browse Source 
Close high-severity findings from the security review: default-deny blob
gets for unmapped hashes, map collection members for ACL, fail closed on
unknown access modes, require vnd1 tickets only, redact tickets from events,
exclude Android app-data backups, and tighten secret-file creation.
This commit is contained in:
Hammed Abass
2026-07-13 18:41:43 +02:00
parent 98375f479a
commit e7fb0331b5
27 changed files with 461 additions and 283 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
androidApp/src/main/res/xml/backup_rules.xml Normal file
View File

@@ -0,0 +1,5 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Exclude core identity, tickets, history, and blob store from Auto Backup. -->
<full-backup-content>
<exclude domain="file" path="vnidrop"/>
</full-backup-content>