Skip to content

OPPO privacy compliance testing rejected #153749

New issue
New issue
Closed
Closed
OPPO privacy compliance testing rejected#153749
Labels
in triagePresently being triaged by the triage teamwaiting for responseThe Flutter team cannot make further progress on this issue until the original reporter responds

Description

@icc-tips
icc-tips
opened on Aug 20, 2024

Steps to reproduce

1.2 APP 以个人信息处理规则弹窗等形式向用户明示个人信息处理的目的、方式和范围，未经
用户同意，存在收集 IMEI、IMSI、设备 MAC 地址、SUPI、SUCI、软件安装列表、位置、联系
人、通话记录、日历、短信、本机 电话号码、图片、音视频等个人信息。
检测结果：不通过
检测详情：(1)APP未经同意，存在收集个人信息的行为
2024-08-20 09:58:34.912 -> 读取已安装的应用
2024-08-20 10:00:17.581 -> 弹出隐私政策
Intent { act=android.intent.action.PROCESS_TEXT typ=text/plain }
at android.app.ApplicationPackageManager.queryIntentActivitiesAsUser()
a t
android.app.ApplicationPackageManager.queryIntentActivities(ApplicationPackageManager.jav
a:914)
at io.flutter.plugin.text.ProcessTextPlugin.cacheResolveInfos(ProcessTextPlugin.java:118)
at io.flutter.plugin.text.ProcessTextPlugin.queryTextActions(ProcessTextPlugin.java:52)
a t
io.flutter.embedding.engine.systemchannels.ProcessTextChannel$1.onMethodCall(ProcessTextC
hannel.java:63)
a t
io.flutter.plugin.common.MethodChannel$IncomingMethodCallHandler.onMessage(MethodChannel.
java:267)
at io.flutter.embedding.engine.dart.DartMessenger.invokeHandler(DartMessenger.java:292)
at io.flutter.embedding.engine.dart.DartMessenger.lambda$dispatchMessageToQueue$0$io�flutter-embedding-engine-dart-DartMessenger(DartMessenger.java:319)
at io.flutter.embedding.engine.dart.DartMessenger$$ExternalSyntheticLambda0.run(Unknown
Source:12)
at android.os.Handler.handleCallback(Handler.java:790)
at android.os.Handler.dispatchMessage(Handler.java:99)
at android.os.Looper.loop(Looper.java:164)
at android.app.ActivityThread.main(ActivityThread.java:6554)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:558)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:810)
改进建议：建议在用户同意隐私政策之后，APP开始收集用户个人信息。
证据截图：(无)

Expected results

I like to be able to access Oppo's privacy compliance policy

Actual results

OPPO privacy compliance testing rejected

Code sample

Code sample 
[Paste your code here]

Screenshots or Video

Screenshots / Video demonstration

[Upload media here]

Logs

Logs 
[Paste your logs here]

Flutter Doctor output

Doctor output 
[Paste your output here]

Activity

  1. huycozy
    added
    in triagePresently being triaged by the triage team
    on Aug 21, 2024

  2. huycozy commented on Aug 21, 2024

    @huycozy
    huycozy
    on Aug 21, 2024
    Member

    English version (using https://translate.google.com):

    1.2 The APP clearly informs users of the purpose, method and scope of personal information processing in the form of pop-up windows of personal information processing rules, and collects personal information such as IMEI, IMSI, device MAC address, SUPI, SUCI, software installation list, location, contacts, call records, calendar, text messages, local phone number, pictures, audio and video without the user's consent.
Test result: Failed
Test details: (1) The APP collects personal information without consent
2024-08-20 09:58:34.912 -> Read installed applications
2024-08-20 10:00:17.581 -> Pop-up privacy policy

Intent { act=android.intent.action.PROCESS_TEXT typ=text/plain }
at android.app.ApplicationPackageManager.queryIntentActivitiesAsUser()
a t
android.app.ApplicationPackageManager.queryIntentActivities(ApplicationPackageManager.jav
a:914)
at io.flutter.plugin.text.ProcessTextPlugin.cacheResolveInfos(ProcessTextPlugin.java:118)
at io.flutter.plugin.text.ProcessTextPlugin.queryTextActions(ProcessTextPlugin.java:52)
a t
io.flutter.embedding.engine.systemchannels.ProcessTextChannel$1.onMethodCall(ProcessTextC
hannel.java:63)
a t
io.flutter.plugin.common.MethodChannel$IncomingMethodCallHandler.onMessage(MethodChannel.
java:267)
at io.flutter.embedding.engine.dart.DartMessenger.invokeHandler(DartMessenger.java:292)
at io.flutter.embedding.engine.dart.DartMessenger.lambda$dispatchMessageToQueue$0$io�flutter-embedding-engine-dart-DartMessenger(DartMessenger.java:319)
at io.flutter.embedding.engine.dart.DartMessenger$$ExternalSyntheticLambda0.run(Unknown
Source:12)
at android.os.Handler.handleCallback(Handler.java:790)
at android.os.Handler.dispatchMessage(Handler.java:99)
at android.os.Looper.loop(Looper.java:164)
at android.app.ActivityThread.main(ActivityThread.java:6554)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:558)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:810)

Improvement suggestions: It is recommended that the APP start collecting user personal information after the user agrees to the privacy policy.
Evidence screenshots: (none)

  3. huycozy commented on Aug 21, 2024

    @huycozy
    huycozy
    on Aug 21, 2024
    Member

    Hi @icc-tips
    Are you frequently reading the clipboard content when using TextField widget on your app? (May be similar to #101196)

    Please consider posting issue in English that will help people can assist better. Thanks!

  4. huycozy
    added
    waiting for responseThe Flutter team cannot make further progress on this issue until the original reporter responds
    on Aug 21, 2024

  5. NeverOvO commented on Aug 26, 2024

    @NeverOvO
    NeverOvO
    on Aug 26, 2024

    Intent { act=android.intent.action.PROCESS_TEXT typ=text/plain } at android.app.ApplicationPackageManager.queryIntentActivitiesAsUser() at android.app.ApplicationPackageManager.queryIntentActivities(ApplicationPackageManager.java:914) at p8.a.c(ProcessTextPlugin.java:47) at p8.a.b(ProcessTextPlugin.java:5) at l8.n$a.onMethodCall(ProcessTextChannel.java:46) at m8.j$a.a(MethodChannel.java:18) at a8.c.l(DartMessenger.java:19) at a8.c.m(DartMessenger.java:42) at a8.c.g(DartMessenger.java:1) at a8.b.run(R8$$SyntheticClass:13) at android.os.Handler.handleCallback(Handler.java:790) at android.os.Handler.dispatchMessage(Handler.java:99) at android.os.Looper.loop(Looper.java:164) at android.app.ActivityThread.main(ActivityThread.java:6554) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:558) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:810)

    同一的问题，目前中国的VIVO和OPPO提示违规读取剪切板和读取已安装的应用的问题，导致无法通过审核
    The same issue is currently being raised by VIVO and OPPO in China, who are reporting violations of accessing clipboard and installed applications, resulting in the inability to pass the review process

    在3.19.3版本时，修改此处/flutter/packages/flutter/lib/src/widgets/editable_text.dart的源代码可以修复这个权限问题。
    In version 3.19.3, modifying the source code of /flutter/packages/flutter/lib/src/widgets/editable_text.dart here can fix this permission issue.

    截屏2024-08-26 16 45 57

  6. bleroux commented on Aug 26, 2024

    @bleroux
    bleroux
    on Aug 26, 2024
    Contributor

    @icc-tips @NeverOvO Can you share you android manifest file?

  7. NeverOvO commented on Aug 27, 2024

    @NeverOvO
    NeverOvO
    on Aug 27, 2024

    👌

    `

    <uses-feature android:name="android.hardware.camera" android:required="false" />

<uses-permission android:name="android.permission.INTERNET"/>
<uses-permission android:name="android.permission.CAMERA"/>
<uses-permission android:name="android.permission.RECORD_AUDIO"/>
<uses-permission android:name="android.permission.READ_PHONE_STATE" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.MANAGE_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.READ_MEDIA_IMAGES" />
<uses-permission android:name="android.permission.READ_MEDIA_VIDEO" />
<uses-permission android:name="android.permission.VIBRATE" />
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
<uses-permission android:name="android.permission.NFC"/>
<uses-permission android:name="com.huawei.android.launcher.permission.CHANGE_BADGE "/>
<uses-permission android:name="com.hihonor.android.launcher.permission.CHANGE_BADGE" />
<uses-permission android:name="com.vivo.notification.permission.BADGE_ICON" />

<application
    tools:replace="android:label"
    android:label="XXXXXX"
    android:name="${applicationName}"
    android:icon="@mipmap/ic_launcher"
    android:usesCleartextTraffic="true"
    android:requestLegacyExternalStorage="true">
    <activity
        android:name=".MainActivity"
        android:icon="@mipmap/ic_launcher"
        android:exported="true"
        android:launchMode="singleTop"
        android:theme="@style/LaunchTheme"
        android:networkSecurityConfig="@xml/network_security_config"
        android:requestLegacyExternalStorage="true"
        android:screenOrientation="portrait"
        android:configChanges="orientation|keyboardHidden|keyboard|screenSize|smallestScreenSize|locale|layoutDirection|fontScale|screenLayout|density|uiMode"
        android:hardwareAccelerated="true"
        android:windowSoftInputMode="adjustResize"
        tools:ignore="Instantiatable">
        <!-- Specifies an Android theme to apply to this Activity as soon as
             the Android process has started. This theme is visible to the user
             while the Flutter UI initializes. After that, this theme continues
             to determine the Window background behind the Flutter UI. -->
        <meta-data
          android:name="io.flutter.embedding.android.NormalTheme"
          android:resource="@style/NormalTheme"
          />
        <intent-filter>
            <action android:name="android.intent.action.MAIN"/>
            <category android:name="android.intent.category.LAUNCHER"/>
        </intent-filter>
    </activity>

    <!-- Since JCore2.0.0 Required SDK核心功能-->
    <!-- 可配置android:process参数将Service放在其他进程中；android:enabled属性不能是false -->
    <!-- 这个是自定义Service，要继承极光JCommonService，可以在更多手机平台上使得推送通道保持的更稳定 -->
    <service android:name=".common.UserService"
        android:enabled="true"
        android:exported="false"
        android:process=":pushcore">
        <intent-filter>
            <action android:name="cn.jiguang.user.service.action" />
        </intent-filter>
    </service>

    <service android:name=".jpush.PushMessageService"
        android:exported="false">
        <intent-filter>
            <action android:name="cn.jpush.android.intent.SERVICE_MESSAGE" />
            <category android:name="${applicationId}"></category>
        </intent-filter>
    </service>
    <!-- Don't delete the meta-data below.
         This is used by the Flutter tool to generate GeneratedPluginRegistrant.java -->
    <meta-data
        android:name="flutterEmbedding"
        android:value="2" />
</application>

    `

  8. bleroux commented on Aug 27, 2024

    @bleroux
    bleroux
    on Aug 27, 2024
    Contributor

    Thanks 🙏

    Can you test if adding the following section at the end of your manifest file fixes the issue?

          ...
    </application>
    <!-- Required to query activities that can process text, see:
         https://developer.android.com/training/package-visibility and
         https://developer.android.com/reference/android/content/Intent#ACTION_PROCESS_TEXT.

         In particular, this is used by the Flutter engine in io.flutter.plugin.text.ProcessTextPlugin. -->
    <queries>
        <intent>
            <action android:name="android.intent.action.PROCESS_TEXT"/>
            <data android:mimeType="text/plain"/>
        </intent>
    </queries>
</manifest>

  9. NeverOvO commented on Aug 27, 2024

    @NeverOvO
    NeverOvO
    on Aug 27, 2024
    1. 违规收集个人信息
      1.2

    APP 以个人信息处理规则弹窗等形式向用户明示个人信息处理的目的、方式和范围，未经用户同意，存在收集 IMEI、IMSI、设备 MAC 地址、SUPI、SUCI、软件安装列表、位置、联系人、通话记录、日历、短信、本机 电话号码、图片、音视频等个人信息
    检测详情：
    APP未经同意，存在收集个人信息的行为 (详情)
    2024-08-27 14:31:25 启动APP，开始检测
    2024-08-27 14:31:25 Start the app and begin testing

    2024-08-27 14:31:28 读取已安装的应用
    2024-08-27 14:31:28 Read installed applications

    2024-08-27 14:33:14 APP启动完毕
    2024-08-27 14:33:14 APP startup completed
    改进建议：
    建议在用户同意隐私政策之后，APP开始收集用户个人信息。

    添加如图代码后，进行上传检测，反馈依然相同
    After adding the code as shown in the picture, perform upload detection and the feedback remains the same

    截屏2024-08-27 14 41 07

    OPPO那会把读取剪切板认为是读取已安装应用列表，xiaomi平台会提示为未经允许前读取用户剪切板
    OPPO will consider reading the clipboard as reading the list of installed applications, while Xiaomi platform will prompt to read the user clipboard without permission

  10. github-actions commented on Sep 11, 2024

    @github-actions
    github-actionsBot
    on Sep 11, 2024 – with GitHub Actions

    Without additional information, we are unfortunately not sure how to resolve this issue. We are therefore reluctantly going to close this bug for now.
    If you find this problem please file a new issue with the same description, what happens, logs and the output of 'flutter doctor -v'. All system setups can be slightly different so it's always better to open new issues and reference the related ones.
    Thanks for your contribution.

  11. github-actions
    closed this as completedon Sep 11, 2024

  12. github-actions commented on Sep 25, 2024

    @github-actions
    github-actionsBot
    on Sep 25, 2024 – with GitHub Actions

    This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.

  13. github-actions
    locked as resolved and limited conversation to collaborators on Sep 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    in triagePresently being triaged by the triage teamwaiting for responseThe Flutter team cannot make further progress on this issue until the original reporter responds

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions