2

This question was found on SO. The answer there does not satisfactorily answer the question and since it is a security one and one that warrants a good technical explanation, I am reposting it here. Please let me know if this is not appropriate.


Following the Google developer instructions on implementing Firebase in my app, I notice that android lint complains.

The idea is that we have to implement two services which inherit from Firebase services:

public class MyFirebaseInstanceIDService extends FirebaseInstanceIdService { ... }

public class MyFirebaseMessagingService extends FirebaseMessagingService { ... }

and then register those services in the manifest. But, it's not quite perfect. In particular, these two recommended AndroidManifest.xml service entries do not contain any special permissions:

<service android:name=".MyFirebaseMessagingService">
    <intent-filter>
        <action android:name="com.google.firebase.MESSAGING_EVENT"/>
    </intent-filter>
</service>

<service android:name=".MyFirebaseInstanceIDService">
    <intent-filter>
        <action android:name="com.google.firebase.INSTANCE_ID_EVENT"/>
    </intent-filter>
</service>

and so the linter says:

Exported services (services which either set exported=true or contain an intent-filter and do not specify exported=false) should define a permission that an entity must have in order to launch the service or bind to it. Without this, any application can use this service.

Should I just add this attribute to each service tag and be done with it

tools:ignore="ExportedService"

or is there a better approach in this situation? I mean, is it safe to expose these particular Firebase derived services like this?

2 Answers 2

2

If you're using the current FirebaseMessagingService class and not the depricated FirebaseInstanceIdService you can set the

android:exported="false"

as in given in this official document example FirebaseMessagingService

<service
 android:name=".YourFirebaseMessagingService"
 android:exported="false">
  <intent-filter>
     <action android:name="com.google.firebase.MESSAGING_EVENT" />
  </intent-filter>
</service>

and if you're using the old FirebaseInstanceIdService class you don't have to worry about the permission or exported tag because it's stated in the document here Firebase will take care of the security of the service and the intent.

<!-- FirebaseInstanceIdService performs security checks at runtime,
  no need for explicit permissions despite exported="true"             -->
1

This may solve your problem !

<service android:name=".MyFirebaseMessagingService"
 tools:ignore="ExportedService">
    <intent-filter>
        <action android:name="com.google.firebase.MESSAGING_EVENT"/>
    </intent-filter>
</service>

<service android:name=".MyFirebaseInstanceIDService"
 tools:ignore="ExportedService">
    <intent-filter>
        <action android:name="com.google.firebase.INSTANCE_ID_EVENT"/>
    </intent-filter>
</service>

android:exported

This element sets whether the activity can be launched by components of other applications — "true" if it can be, and "false" if not. If "false", the activity can be launched only by components of the same application or applications with the same user ID. If you are using intent filters, you should not set this element "false". If you do so, and an app tries to call the activity, system throws an ActivityNotFoundException. Instead, you should prevent other apps from calling the activity by not setting intent filters for it.

If you do not have intent filters, the default value for this element is "false". If you set the element "true", the activity is accessible to any app that knows its exact class name, but does not resolve when the system tries to match an implicit intent.

This attribute is not the only way to limit an activity's exposure to other applications. You can also use a permission to limit the external entities that can invoke the activity (see the permission attribute).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .