Android

Quote:

I have implemented an application with auto update function. When I release new version on my server then application downloads new .apk and it starts an intent to install new .apk file.

Quote:

Before installing new version, I want that application should be able to uninstall itself.

Quote:

Now I'm thinking to remove all file in Android system's folder reserved to this application, but is it a good way?

Uri packageURI = Uri.parse("package:com.example.nameapp");
                  Intent uninstallIntent = new Intent(Intent.ACTION_DELETE, packageURI);
                  startActivityForResult(uninstallIntent, PICK_CONTACT_UPDATE);
                  //
                  Intent intent = new Intent(Intent.ACTION_VIEW);
                  intent.setDataAndType(Uri.fromFile(new File(Environment.getExternalStorageDirectory() + "/download/" + nomeApp)), "application/vnd.android.package-archive");
                  intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
                  startActivity(intent);//installation is not working

Member 12751865 wrote:

i have already do thiw but seems a bit confusing!

Member 12751865 wrote:

unfortunatelly i can not deal with any of these isues!

Member 12358097 wrote:

...Information Leakage flaw...

Associated Flaws by CWE ID:
	 	Information Exposure Through Sent Data (CWE ID 201)(5 flaws)
Description
Sensitive information may be exposed as a result of outbound network connections made by the application.  This can manifest in a couple of different ways.
In C/C++ applications, sometimes the developer fails to zero out a buffer before populating it with data.  This can cause information leakage if, for example, the buffer contains a data structure for which only certain fields were populated. The uninitialized fields would contain whatever data is present at that memory location.  Sensitive information from previously allocated variables could then be leaked when the buffer is sent over the network.
Mobile applications may also transmit sensitive information such as email or SMS messages, address book entries, GPS location data, and anything else that can be accessed by the mobile API.  This behavior is common in mobile spyware applications designed to exfiltrate data to a listening post or other data collection point.  This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability.  However, in the context of a mobile application, the significance of an information leak may be much greater, especially if misaligned with user expectations or data privacy policies.
Effort to Fix: 2 - Implementation error. Fix is approx. 6-50 lines of code. 1 day to fix.
Recommendations
In C/C++ applications, ensure that all struct elements are initialized or zeroed before being sent.  In mobile applications, ensure that the transfer of sensitive data is intended and that it does not violate application security policy or user expectations.

        Bitmap bitmap = null;
        Uri uri = null;
if (destType == FILE_URI || destType == NATIVE_URI) {
            if (this.saveToPhotoAlbum) {
                Uri inputUri = getUriFromMediaStore();
                try {
                    //Just because we have a media URI doesn't mean we have a real file, we need to make it
                    uri = Uri.fromFile(new File(FileHelper.getRealPath(inputUri, this.cordova)));

                } catch (NullPointerException e) {
                    uri = null;
                }
            } else {
                uri = Uri.fromFile(new File(getTempDirectoryPath(), System.currentTimeMillis() + ".jpg"));
            }

            if (uri == null) {
                this.failPicture("Error capturing image - no media storage found.");
                return;
            }

            // If all this is true we shouldn't compress the image.
            if (this.targetHeight == -1 && this.targetWidth == -1 && this.mQuality == 100 &&
                    !this.correctOrientation) {
                writeUncompressedImage(uri);

                this.callbackContext.success(uri.toString());
            } else {
                bitmap = getScaledBitmap(FileHelper.stripFileProtocol(imageUri.toString()));

                if (rotate != 0 && this.correctOrientation) {
                    bitmap = getRotatedBitmap(rotate, bitmap, exif);
                }
// warning is for below line ,
                try (OutputStream os = this.cordova.getActivity().getContentResolver().openOutputStream(uri)) {

                    bitmap.compress(Bitmap.CompressFormat.JPEG, this.mQuality, os);

                }

try (OutputStream os = this.cordova.getActivity().getContentResolver().openOutputStream(uri))

Richard MacCutchan wrote:

I just have no idea what you are talking about.