Hi,
Im doing a check of my Delphi App APK with MobSF Application Security, preparing it for a coming pentest.
The only high vulnerability that is left if the case that the com.google.firebase.messaging.FirebaseMessagingService is exported with "true" value on the manifiest.
<service android:exported="true" android:name="com.google.firebase.messaging.FirebaseMessagingService">
<intent-filter android:priority="-500">
<action android:name="com.google.firebase.MESSAGING_EVENT" />
</intent-filter>
</service>
I have tried several approach for working the solution, in order to get the exported value to "false":
1. Try changing the value on Android.Manifiest.Template file for example... but the value isnt there since Delphi adds this com.google.firebase.messaging.FirebaseMessagingService entry on the Android.Manifiest.xml file at compiling time.
2. Get the generated Android.Manifiest.XML from the /Android/Bin folder after compiling, changing the exported value to false for com.google.firebase.messaging.FirebaseMessagingService and then replace the Android.Manifiest.Template with it. The problem is that Delphi is still generating the automatic exported=true value for the service and is in fact duplicating the value on the Android.Manifiest File
Do anyone know how or we are pre-configured this automatic value that Delphi adxs to the Manifiest when you select that you want to integrate with Firebase?
<service android:exported="true" android:name="com.google.firebase.messaging.FirebaseMessagingService">
<intent-filter android:priority="-500">
<action android:name="com.google.firebase.MESSAGING_EVENT" />
</intent-filter>
</service>
Thanks for any help Guys!