Merge branch 'fix-or-suppress-mobsfscan-issues-droid-531'

6 files changed, 58 insertions, 36 deletions

diff --git a/android/app/src/androidTest/AndroidManifest.xml b/android/app/src/androidTest/AndroidManifest.xml
index 8d37c966e9..7e6663f58c 100644
--- a/android/app/src/androidTest/AndroidManifest.xml
+++ b/android/app/src/androidTest/AndroidManifest.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
-
     <!-- Required on certain Android versions and/or ABIs
     https://github.com/mockk/mockk/issues/297#issuecomment-641361770 -->
-    <application android:extractNativeLibs="true" />
+    <application android:extractNativeLibs="true"
+                 android:allowBackup="false" />
 </manifest>
diff --git a/android/app/src/debug/AndroidManifest.xml b/android/app/src/debug/AndroidManifest.xml
index b1674e98f1..ff2d7e28a0 100644
--- a/android/app/src/debug/AndroidManifest.xml
+++ b/android/app/src/debug/AndroidManifest.xml
@@ -1,25 +1,21 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools">
-
-    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
-    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
-
-    <application
-        android:icon="@mipmap/ic_launcher"
-        android:roundIcon="@mipmap/ic_launcher"
-        android:theme="@style/AppTheme"
-        android:extractNativeLibs="true"
-        android:allowBackup="false"
-        android:banner="@drawable/banner"
-        android:name=".MullvadApplication"
-        tools:ignore="GoogleAppIndexingWarning">
+          xmlns:tools="http://schemas.android.com/tools">
+    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
+    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
+    <application android:icon="@mipmap/ic_launcher"
+                 android:roundIcon="@mipmap/ic_launcher"
+                 android:theme="@style/AppTheme"
+                 android:extractNativeLibs="true"
+                 android:allowBackup="false"
+                 android:banner="@drawable/banner"
+                 android:name=".MullvadApplication"
+                 tools:ignore="GoogleAppIndexingWarning">
         <activity android:name="net.mullvad.mullvadvpn.TestActivity"
-            android:label="@string/app_name"
-            android:launchMode="singleTask"
-            android:configChanges="orientation|screenSize|screenLayout"
-            android:screenOrientation="locked"
-            android:windowSoftInputMode="adjustPan"
-            android:exported="true">
-        </activity>
+                  android:label="@string/app_name"
+                  android:launchMode="singleTask"
+                  android:configChanges="orientation|screenSize|screenLayout"
+                  android:screenOrientation="locked"
+                  android:windowSoftInputMode="adjustPan"
+                  android:exported="true"></activity>
     </application>
 </manifest>
diff --git a/android/app/src/devmole/AndroidManifest.xml b/android/app/src/devmole/AndroidManifest.xml
index 43b74c1f16..602aecb6e4 100644
--- a/android/app/src/devmole/AndroidManifest.xml
+++ b/android/app/src/devmole/AndroidManifest.xml
@@ -1,8 +1,7 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools">
-
-    <application
-        android:icon="@mipmap/ic_launcher"
-        android:label="Devmole VPN"
-        tools:replace="android:label" />
+          xmlns:tools="http://schemas.android.com/tools">
+    <application android:icon="@mipmap/ic_launcher"
+                 android:label="Devmole VPN"
+                 tools:replace="android:label"
+                 android:allowBackup="false" />
 </manifest>
diff --git a/android/app/src/stagemole/AndroidManifest.xml b/android/app/src/stagemole/AndroidManifest.xml
index 3a9d85b0cc..204a6b6290 100644
--- a/android/app/src/stagemole/AndroidManifest.xml
+++ b/android/app/src/stagemole/AndroidManifest.xml
@@ -1,8 +1,7 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools">
-
-    <application
-        android:icon="@mipmap/ic_launcher"
-        android:label="Stagemole VPN"
-        tools:replace="android:label" />
+          xmlns:tools="http://schemas.android.com/tools">
+    <application android:icon="@mipmap/ic_launcher"
+                 android:label="Stagemole VPN"
+                 tools:replace="android:label"
+                 android:allowBackup="false" />
 </manifest>
diff --git a/android/config/config.mobsf b/android/config/config.mobsf
new file mode 100644
index 0000000000..0b00ae401a
--- /dev/null
+++ b/android/config/config.mobsf
@@ -0,0 +1,28 @@
+---
+- ignore-rules:
+  # Sensitive data isn't logged. There's also an external issue to scan log calls (DROID-527).
+  - android_kotlin_logging
+
+  # The kotlin code isn't responsible for any external API communication and therefore the risk for
+  # including sensitive credentials is very small. This check also caused many false-positives since
+  # the keyword "key" is used throughout the app to for arguments, bundles and preferences.
+  - android_kotlin_hardcoded
+
+  # Intentially not prevented due to a technical user base. We might however want to inform users,
+  # which is something we'll review in an externally tracked issue (DROID-528).
+  - android_root_detection
+  - android_safetynet
+
+  # The backend API communication is done by the Mullvad Daemon which is built in rust.
+  - android_ssl_pinning
+  - android_certificate_pinning
+  - android_certificate_transparency
+
+  # Sensitive screens currently prevent screenshots.
+  - android_prevent_screenshot
+
+  # Will be investigate in the externally tracked issue DROID-529.
+  - android_tapjacking
+
+  # We've currently decided to support Android 8.
+  - android_manifest_insecure_minsdk
diff --git a/android/scripts/tidy.sh b/android/scripts/tidy.sh
index 0372febcda..173d42d905 100755
--- a/android/scripts/tidy.sh
+++ b/android/scripts/tidy.sh
@@ -33,7 +33,7 @@ function format {
         --indent-attributes yes \
         --indent-spaces 4 \
         --literal-attributes yes \
-        ../**/src/main/AndroidManifest.xml \
+        ../**/src/*/AndroidManifest.xml \
         ../lib/resource/src/main/res/anim*/*.xml \
         ../lib/resource/src/main/res/drawable*/*.xml \
         ../app/src/main/res/layout*/*.xml