Security Alert: Apache Cordova vulnerabilities in your Google Play app

  • 1
  • Problem
  • Updated 4 years ago
I just got this email from Google about all the apps I have published with PhoneGap.
We rejected Sarv Manager, with package name com.sarv.emailmanager, for violating our Malicious Behavior policy. If you submitted an update, the previous version of your app is still available on Google Play.

This app uses software that contains security vulnerabilities for users.

Below is the list of vulnerabilities and the corresponding APK versions that were detected in your recent submission. Please upgrade your app(s) as soon as possible and increment the version number of the upgraded APK.
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes

Posted 4 years ago

  • 1
Photo of Petra V.

Petra V., Champion

  • 7794 Posts
  • 1391 Reply Likes
Which PGB version are you building with?
(Edited)
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
var PLATFORM_VERSION_BUILD_LABEL = '5.1.1';
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
config file code below...............






EmailManager

A sample Apache Cordova application that responds to the deviceready event.

Apache Cordova Team
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
5.1.1 PGB version
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
var PLATFORM_VERSION_BUILD_LABEL = '5.1.1';
Photo of Petra V.

Petra V., Champion

  • 7794 Posts
  • 1391 Reply Likes
var PLATFORM_VERSION_BUILD_LABEL = '5.1.1';
This is not something you specifiy this way with Phonegap Build.
Anyway, it looks like Google thinks you are using 3.5.0 or earlier, so something is wrong.

Is your zip file, which you uploaded to PGB, available online, somewhere? If so, please post its url and I'll be happy to have a look.
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
please give me contact number
Photo of Petra V.

Petra V., Champion

  • 7794 Posts
  • 1391 Reply Likes
Don't have one. Your contact is here, at the forum.
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
ok.. please give me solutions and i provide details to ask for solutions
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
can you need androidmanifeast.xml file
Photo of Petra V.

Petra V., Champion

  • 7794 Posts
  • 1391 Reply Likes
You don't send an androidManifest.xml file to Phonegap Build, do you?
(If you do, there is something very wrong in the way you are working with PGB)

a. Can you confirm that both index.html and config.xml are in the root ("/") of the zip file you send to PGB?
b. Can you confirm that you only have one file called index.html in your assets?
c. Can you confirm that you only send your assets to PGB, and not a full Cordova project?
d. Please post your config.xml
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
Options D






EmailManager

A sample Apache Cordova application that responds to the deviceready event.

Apache Cordova Team
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
ANDROID MANIFEAST.xml file

<!-- GCM connects to Internet Services. -->

<!-- GCM requires a Google account. -->

<!-- Keeps the processor from sleeping when a message is received. -->

<!-- Creates a custom permission so only this app can receive its messages. -->

<!-- This app has permission to register and receive data message. -->

<!-- Permission to vibrate -->

<!-- Set User Permissions -->

<!-- Set User Permissions -->

<!-- Permission to File Read Write -->
Photo of Petra V.

Petra V., Champion

  • 7794 Posts
  • 1391 Reply Likes
Wrap your code in a CODE element as described under "some HTML allowed"
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
OPTIONS A
public static String getStartUrl() {
if (parser == null) {
return "file:///android_asset/www/index.html";

}
return parser.getLaunchUrl();
}
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
Only one file call all pages view navigation
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
i don't understand above line
This is not something you specifiy this way with Phonegap Build.
Anyway, it looks like Google thinks you are using 3.5.0 or earlier, so something is wrong.

Is your zip file, which you uploaded to PGB, available online, somewhere? If so, please post its url and I'll be happy to have a look.
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
i m just create build updated and upload app reject every time ?
Photo of Petra V.

Petra V., Champion

  • 7794 Posts
  • 1391 Reply Likes
I have no idea what the code above is. But it's not something you should upload to PGB.

Please answer/confirm the points I mentioned above.

I'll be on the road for several hours, but will check back later.
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
i m upload app on play store but every time reject
Vulnerability APK Version(s)
Apache Cordova
The vulnerabilities were fixed in Apache Cordova v.3.5.1.

please provide me give a solutions ...
Photo of Chris Griffith

Chris Griffith, Champion

  • 347 Posts
  • 92 Reply Likes
You can define which version of PhoneGap to compile with by using this
<preference name="phonegap-version" value="cli-5.2.0" />
within you config.xml file

For information visit:

http://docs.build.phonegap.com/en_US/...
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
Photo of JesseMonroy650 (Volunteer)

JesseMonroy650 (Volunteer), Champion

  • 3325 Posts
  • 122 Reply Likes
@Gaurav,
do you speak spanish?
hablas español?
Jesse
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
Photo of JesseMonroy650 (Volunteer)

JesseMonroy650 (Volunteer), Champion

  • 3325 Posts
  • 122 Reply Likes
is that no?
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
please help
Photo of Petra V.

Petra V., Champion

  • 7794 Posts
  • 1391 Reply Likes
Please answer/confirm the points I mentioned above.
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
again upload app then reject today again please help...
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
Apache Cordova
Las vulnerabilidades se fijaron en Apache Cordova V.3.5.1.
aplicación cada vez que rechazan por favor ayuda de urgencia
Photo of JesseMonroy650 (Volunteer)

JesseMonroy650 (Volunteer), Champion

  • 3325 Posts
  • 122 Reply Likes
- SEE BELOW
- VEA ABAJO
Photo of JesseMonroy650 (Volunteer)

JesseMonroy650 (Volunteer), Champion

  • 3325 Posts
  • 122 Reply Likes
@Gaurav
When posting code, please use some HTML (like <code></code>). (see attached image)

Photo of JesseMonroy650 (Volunteer)

JesseMonroy650 (Volunteer), Champion

  • 3325 Posts
  • 122 Reply Likes
https://translate.google.com/#en/es/

- do you speak spanish?
- hablas español?
Photo of JesseMonroy650 (Volunteer)

JesseMonroy650 (Volunteer), Champion

  • 3325 Posts
  • 122 Reply Likes
https://translate.google.com/#en/es/


- Apache Cordova
Las vulnerabilidades se fijaron en Apache Cordova V.3.5.1.
aplicación cada vez que rechazan por favor ayuda de urgencia
- Apache Cordova
Google: The vulnerabilities were fixed in Apache Cordova V.3.5.1.
whenever application please refuse emergency aid

- Me 10 minutes/ Yo con 10 minutos
The vulnerabilities they find in Apache Cordova V.3.5.1 application
every time they reject (it). Please help is urgently need.


- Your english is bad. Your spanish is bad. What language do you speak.
- Tu inglés es malo. Su español es malo. Qué idioma hablas.

- How do we communicate?
- ¿Cómo nos comunicamos?

Jesse
Photo of Gaurav Mangal

Gaurav Mangal

  • 26 Posts
  • 0 Reply Likes
please give answer in english only.
Photo of JesseMonroy650 (Volunteer)

JesseMonroy650 (Volunteer), Champion

  • 3325 Posts
  • 122 Reply Likes
@Gaurav
YOUR ENGLISH BAD. Explaining in english will not help.
Give your language.
Jesse
Photo of Petra V.

Petra V., Champion

  • 7794 Posts
  • 1391 Reply Likes
I'll just try once more:

Is your zip file, which you uploaded to PGB, available online, somewhere? If so, please post its url and I'll be happy to have a look.

[If not, I'll give up]
Photo of JesseMonroy650 (Volunteer)

JesseMonroy650 (Volunteer), Champion

  • 3325 Posts
  • 122 Reply Likes
This person can comprehend english or speak english. I'm up for the next 24 hours.

Jesse