{"action":"created","issue":{"url":"https://api.github.com/repos/godotengine/godot/issues/19168","repository_url":"https://api.github.com/repos/godotengine/godot","labels_url":"https://api.github.com/repos/godotengine/godot/issues/19168/labels{/name}","comments_url":"https://api.github.com/repos/godotengine/godot/issues/19168/comments","events_url":"https://api.github.com/repos/godotengine/godot/issues/19168/events","html_url":"https://github.com/godotengine/godot/issues/19168","id":326665928,"number":19168,"title":"Godot default android export template includes permission requests that were not requested","user":{"login":"hasherkeen","id":14890356,"avatar_url":"https://avatars0.githubusercontent.com/u/14890356?v=4","gravatar_id":"","url":"https://api.github.com/users/hasherkeen","html_url":"https://github.com/hasherkeen","followers_url":"https://api.github.com/users/hasherkeen/followers","following_url":"https://api.github.com/users/hasherkeen/following{/other_user}","gists_url":"https://api.github.com/users/hasherkeen/gists{/gist_id}","starred_url":"https://api.github.com/users/hasherkeen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hasherkeen/subscriptions","organizations_url":"https://api.github.com/users/hasherkeen/orgs","repos_url":"https://api.github.com/users/hasherkeen/repos","events_url":"https://api.github.com/users/hasherkeen/events{/privacy}","received_events_url":"https://api.github.com/users/hasherkeen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-05-25T21:14:28Z","updated_at":"2018-05-25T21:34:56Z","closed_at":null,"author_association":"NONE","body":"**Godot version:**\r\n2.1.4 - 2,1.5\r\n\r\n**OS/device including version:**\r\nAndroid\r\n\r\n**Issue description:**\r\nGodot default android export template includes permission requests that were not requested.\r\n\r\nA week back my apps were removed from Google Play for requesting sensitive permissions and for not including a Privacy Policy file. After talking to the support staff i was told that my games requested the following permissions:\r\n\r\nandroid.permission.READ_PHONE_STATE \r\nandroid.permission.RECORD_AUDIO\r\nandroid.permission.GET_ACCOUNTS\r\nandroid.permission.READ_CONTACTS\r\nandroid.permission.CAMERA\r\n\r\nWhich i've never toggled during the export process.\r\n\r\nAnd, i believe, purging everything between line 37 to line 202 off the AndroidManifest.xml.template is not enough, as there are still sensitive permissions being requested in the background.\r\n\r\nAfter opening a compiled export template APK in Android Studio and doing a a global tree search, by hitting ctrl+shift+f and entering 'android.permission', there is, oddly, a fair amount of sensitive permissions being requested.\r\n\r\nHere's a list of some of those i've found:\r\n\r\n**FILE NAME: FingerprintManagerCompat.smali**\r\nvalue = \"android.permission.USE_FINGERPRINT\"\r\n\r\n**FILE NAME: zzaqo.smali**\r\nconst-string v2, \"android.permission.ACCESS_COARSE_LOCATION\"\r\nconst-string v2, \"android.permission.ACCESS_FINE_LOCATION\"\r\n\r\n**FILE NAME: zzaiw.smali**\r\nconst-string v2, \"android.permission.RECORD_AUDIO\"\r\nconst-string v2, \"android.permission.CAMERA\"\r\n\r\n**FILE NAME: zzmw.smali**\r\nconst-string v1, \"android.permission.WRITE_EXTERNAL_STORAGE\"\r\n\r\n**FILE NAME: WorkSourceUtil.smali**\r\nconst-string v2, \"android.permission.UPDATE_DEVICE_STATS\"\r\n\r\nThese appear to be generated during the compilation process for no apparent reason.\r\n"},"comment":{"url":"https://api.github.com/repos/godotengine/godot/issues/comments/392193445","html_url":"https://github.com/godotengine/godot/issues/19168#issuecomment-392193445","issue_url":"https://api.github.com/repos/godotengine/godot/issues/19168","id":392193445,"user":{"login":"akien-mga","id":4701338,"avatar_url":"https://avatars0.githubusercontent.com/u/4701338?v=4","gravatar_id":"","url":"https://api.github.com/users/akien-mga","html_url":"https://github.com/akien-mga","followers_url":"https://api.github.com/users/akien-mga/followers","following_url":"https://api.github.com/users/akien-mga/following{/other_user}","gists_url":"https://api.github.com/users/akien-mga/gists{/gist_id}","starred_url":"https://api.github.com/users/akien-mga/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akien-mga/subscriptions","organizations_url":"https://api.github.com/users/akien-mga/orgs","repos_url":"https://api.github.com/users/akien-mga/repos","events_url":"https://api.github.com/users/akien-mga/events{/privacy}","received_events_url":"https://api.github.com/users/akien-mga/received_events","type":"User","site_admin":false},"created_at":"2018-05-25T21:34:56Z","updated_at":"2018-05-25T21:34:56Z","author_association":"MEMBER","body":"That's a duplicate of #18192.\r\n\r\n> Here's a list of some of those i've found:\r\n>\r\n> FILE NAME: FingerprintManagerCompat.smali\r\n> value = \"android.permission.USE_FINGERPRINT\"\r\n> \r\n> FILE NAME: zzaqo.smali\r\n> const-string v2, \"android.permission.ACCESS_COARSE_LOCATION\"\r\n> const-string v2, \"android.permission.ACCESS_FINE_LOCATION\"\r\n\r\nI don't know what those are but they're not defined by Godot. (You can grep for those permission names, you'll only find references to the placeholders and the logic that can replace them when asked for by actual permissions).\r\nWhen you upload a game to Google Play, or try to install it on a device, it doesn't ask for any of the permissions you listed above unless you explicitly requested them."}}
{"actor":{"display_login":"akien-mga"}}