TeamAmaze / TeamAmaze/AmazeFileManager

Some Incompatible API Usages in APP

Open
#3,194 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Area-CodeHealth Issue-Bug
Dominant language
Kotlin
Stars
6.4k
Forks
1.7k
Avg merge
3d 9h
Merged PRs (30d)
1

Description

For your app, we have found that this project has accessed the following APIs which are available only on an API level higher than the declared minSdkVersion and which are accessed without proper protection. In other words, if those APIs get called at runtime, it will trigger a NoSuchMethodError and thus result in a crash of the running application.

  1. <android.content.Context: int getColor(int)>: [23,30]
Error path: <com.amaze.filemanager.asynchronous.services.ZipService: void <init>()>[[]]--><com.amaze.filemanager.asynchronous.services.AbstractProgressiveService: void <init>()>[[]]--><android.content.Context: void <init>()>[]--><android.content.Context: int getColor(int)>

Error path: <com.amaze.filemanager.asynchronous.services.EncryptService: void <init>()>[[]]--><com.amaze.filemanager.asynchronous.services.AbstractProgressiveService: void <init>()>[[]]--><android.content.Context: void <init>()>[]--><android.content.Context: int getColor(int)>

You can add an if-then check like "If(Build.VERSION.SDK_INT >= 23)" when invoking this API to prevent compatibility issues.

  1. <android.security.keystore.KeyGenParameterSpec.Builder: android.security.keystore.KeyGenParameterSpec.Builder setBlockModes(java.lang.String[])>: [23,30]
Error path: <com.amaze.filemanager.asynchronous.services.EncryptService$BackgroundTask: java.lang.Void doInBackground(java.lang.Void[])>[[]]--><com.amaze.filemanager.filesystem.files.CryptUtil: void <init>(android.content.Context,com.amaze.filemanager.filesystem.HybridFileParcelable,com.amaze.filemanager.utils.ProgressHandler,java.util.ArrayList,java.lang.String)>[]--><com.amaze.filemanager.filesystem.files.CryptUtil: void aesDecrypt(java.io.BufferedInputStream,java.io.BufferedOutputStream)>[[]]--><com.amaze.filemanager.filesystem.files.CryptUtil: java.security.Key getSecretKey()>[[]]--><android.security.keystore.KeyGenParameterSpec.Builder: void <init>(java.lang.String,int)>[]--><android.security.keystore.KeyGenParameterSpec.Builder: android.security.keystore.KeyGenParameterSpec.Builder setBlockModes(java.lang.String[])>

You can add an if-then check like "If(Build.VERSION.SDK_INT >= 23)" when invoking this API to prevent compatibility issues.

3.<android.view.View: void setBackgroundTintList(android.content.res.ColorStateList)>:[21,30]

Error path: <com.amaze.filemanager.ui.activities.MainActivity: void onActivityResult(int,int,android.content.Intent)>[[]]--><com.amaze.filemanager.ui.views.drawer.Drawer: void onActivityResult(int,int,android.content.Intent)>[[$i0 >= 19]]--><com.amaze.filemanager.ui.views.drawer.Drawer: void setDrawerHeaderBackground()>[[]]--><android.view.View: void <init>(android.content.Context)>[]--><android.view.View: void setBackgroundTintList(android.content.res.ColorStateList)>

You can add an if-then check like "If(Build.VERSION.SDK_INT >= 21)" when invoking this API to prevent compatibility issues.

3.<android.content.Context: java.io.File[] getExternalFilesDirs(java.lang.String)>:[19,30]

Error path: <com.amaze.filemanager.asynchronous.services.ZipService: void <init>()>[[]]--><com.amaze.filemanager.asynchronous.services.AbstractProgressiveService: void <init>()>[[]]--><android.content.Context: void <init>()>[]--><android.content.Context: java.io.File[] getExternalFilesDirs(java.lang.String)>
Error path: <com.amaze.filemanager.asynchronous.services.CopyService: void <init>()>[[]]--><com.amaze.filemanager.asynchronous.services.AbstractProgressiveService: void <init>()>[[]]--><android.content.Context: void <init>()>[]--><android.content.Context: java.io.File[] getExternalFilesDirs(java.lang.String)>

You can add an if-then check like "If(Build.VERSION.SDK_INT >= 19)" when invoking this API to prevent compatibility issues.

4.<javax.crypto.spec.GCMParameterSpec: void (int,byte[])>:[19,30]

Error path: <com.amaze.filemanager.asynchronous.services.EncryptService$BackgroundTask: java.lang.Void doInBackground(java.lang.Void[])>[[]]--><com.amaze.filemanager.filesystem.files.CryptUtil: void <init>(android.content.Context,com.amaze.filemanager.filesystem.HybridFileParcelable,com.amaze.filemanager.utils.ProgressHandler,java.util.ArrayList,java.lang.String)>[]--><com.amaze.filemanager.filesystem.files.CryptUtil: void aesDecrypt(java.io.BufferedInputStream,java.io.BufferedOutputStream)>[[]]--><javax.crypto.spec.GCMParameterSpec: void <init>(int,byte[])>

You can add an if-then check like "If(Build.VERSION.SDK_INT >= 19)" when invoking this API to prevent compatibility issues.

5.<android.security.keystore.KeyGenParameterSpec.Builder: android.security.keystore.KeyGenParameterSpec.Builder setRandomizedEncryptionRequired(boolean)>
:[23,30]

Error path: <com.amaze.filemanager.asynchronous.services.EncryptService$BackgroundTask: java.lang.Void doInBackground(java.lang.Void[])>[[]]--><com.amaze.filemanager.filesystem.files.CryptUtil: void <init>(android.content.Context,com.amaze.filemanager.filesystem.HybridFileParcelable,com.amaze.filemanager.utils.ProgressHandler,java.util.ArrayList,java.lang.String)>[]--><com.amaze.filemanager.filesystem.files.CryptUtil: void aesDecrypt(java.io.BufferedInputStream,java.io.BufferedOutputStream)>[[]]--><com.amaze.filemanager.filesystem.files.CryptUtil: java.security.Key getSecretKey()>[[]]--><android.security.keystore.KeyGenParameterSpec.Builder: android.security.keystore.KeyGenParameterSpec.Builder setRandomizedEncryptionRequired(boolean)>

You can add an if-then check like "If(Build.VERSION.SDK_INT >= 23)" when invoking this API to prevent compatibility issues.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Inspect the API call paths named in ZipService, CopyService, EncryptService, CryptUtil, Drawer, and MainActivity, focusing on the listed Android and cryptography APIs. Verify the app's minimum supported API level and add compatibility protection for each affected call. Done means the reported NoSuchMethodError paths are safe on supported Android versions.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java, kotlin
Domain
mobile, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.