-
Notifications
You must be signed in to change notification settings - Fork 375
Adds Support For Loading Native Libraries From Alternative Path #86
Conversation
Summary: In order to support not shipping the native libraries with an APK and instead downloading the architecture specific .so files from the network and storing them in an app's data folder, this adds support for setting an alternative lib search path via the `CardIONativeLibsConfig`. Test Plan: - Verified that manual entry screen is displayed when native libs are not downloaded / available. - Verified that setting the alterantive path works and the camera screen is shown.
If the native libraries are not present, does |
/** | ||
* A config class that is used to specify an alternative search path for the native libraries. | ||
* | ||
* It's primary use case is for when the libraries are loaded over the network instead of being |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Its, not it's.
@lkorth Yes, because Since |
Going forward, at some point a new major version is going to be required and |
Ah okay. Perhaps at that point this could be changed as well. The config solution seemed clean but the Also tested with |
Sorry for the late response. I'm concerned about the security implications of this change. Could a malicious actor replace these downloaded files easier than an apk? |
Yes, possibly if they know the path in the app's directory (and the device is rooted). As far as I know, app A cannot modify app B's data directory (unless they share the same id). In our case, I verify the lib files integrity on each application start by matching the files against expected MD5 hashes to ensure file integrity. As far as I know, it's possible to have two files with the same Hash but I'm not sure if that's possible with compiled files (unless they can be altered without corruption). If a device is rooted though, it seems that a malicious actor could replace the (APK) packaged so files in the extracted APK directory just as easy as replacing them in the app's data directory. |
Agree. I'll go ahead and merge this PR, and it will go out in the next release. |
Summary: In order to support not shipping the native libraries
with an APK and instead downloading the architecture specific
.so files from the network and storing them in an app's data
folder, this adds support for setting an alternative lib search
path via the
CardIONativeLibsConfig
.Test Plan: