Exposure notifications: check for location permission broken
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 14.6k
- Forks
- 3.2k
- Avg merge
- 12d 11h
- Merged PRs (30d)
- 4
Description
I originally observed the effects of this issue in Corona Contact Tracing Germany. In short, CCTG shows a "Exposure notifications disabled" warning while still collecting keys (https://codeberg.org/corona-contact-tracing-germany/cwa-android/issues/79). After further investigations, I also observed the reverse issue (no notification and not collecting keys) and came to the conclusion that the issue is in microG.
What's happening is the following:
- microG is using BLE scanning (correctly), which requires the permissions BLUETOOTH_ADMIN and one of ACCESS_COARSE_LOCATION or ACCESS_FINE_LOCATION.
- microG does not check whether it was granted one of the location permissions, but instead it checks whether location services are enabled on the device, which is unrelated.
- As a result, microG shows a warning falsely if it has location permission but location services are disabled (approximately the issue I reported in CCTG), while still collecting keys. Perhaps more severe, it does not show a warning if it does not have location permission but location services are enabled.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing microG's BLE scanning permission check and compare its use of granted location permissions with the device's location-services state. Reproduce both reported cases: warning with permission granted, and no warning without permission; done when the warning and key collection behavior reflect the actual required permission.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, java
- Domain
- mobile
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100