🔒 Disable Auto Backup to prevent data leakage - #36
Conversation
Co-authored-by: Devasy23 <110348311+Devasy23@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
WalkthroughThe Changes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@workout-logger/android/app/src/main/AndroidManifest.xml`:
- Around line 5-6: The manifest currently only sets android:allowBackup="false"
which is insufficient on Android 12+; update the <application> attributes to add
android:dataExtractionRules="@xml/data_extraction_rules" and
android:fullBackupContent="@xml/backup_rules", and add the two XML resources
(res/xml/data_extraction_rules.xml and res/xml/backup_rules.xml) containing
explicit exclude entries for root, file, database, sharedpref, and external
domains for both cloud-backup and device-transfer (data_extraction_rules) and
full-backup-content (backup_rules) so all data domains are excluded.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 5859fe1c-aa66-497d-bf35-b2c629ca4117
📒 Files selected for processing (1)
workout-logger/android/app/src/main/AndroidManifest.xml
| android:icon="@mipmap/ic_launcher" | ||
| android:allowBackup="false"> |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
According to the latest Android documentation, does android:allowBackup="false"fully disable both cloud backup and device-to-device transfer on Android 12+? If not, what exact combination ofallowBackup, fullBackupContent, and dataExtractionRules is recommended to guarantee no app data backup/transfer?
💡 Result:
No, according to the latest Android documentation, setting android:allowBackup="false" does not fully disable both cloud backup and device-to-device (D2D) transfer on Android 12+. On devices from some manufacturers, android:allowBackup="false" disables cloud backups (e.g., Google Drive) but does not disable D2D transfers. To guarantee no app data backup or transfer on Android 12+, use the following combination in the AndroidManifest.xml element: android:allowBackup="false" android:dataExtractionRules="@xml/data_extraction_rules" Create res/xml/data_extraction_rules.xml with excludes for all domains in both and : For compatibility with Android 11 and lower, also add android:fullBackupContent="@xml/backup_rules" with similar excludes in a backup_rules.xml file using syntax. This configuration explicitly excludes all app data from both cloud backups and D2D transfers while disabling legacy backups.
Citations:
- 1: https://developer.android.com/identity/data/autobackup
- 2: https://developer.android.com/privacy-and-security/risks/backup-best-practices
- 3: https://developer.android.com/about/versions/12/behavior-changes-12
Add explicit data extraction rules to fully disable backups on Android 12+.
Setting android:allowBackup="false" alone does not prevent device-to-device transfers on some Android 12+ devices. Add android:dataExtractionRules="@xml/data_extraction_rules" with explicit excludes for all data domains, and android:fullBackupContent="@xml/backup_rules" for Android 11 compatibility.
Manifest and configuration files required
Update AndroidManifest.xml:
<application
android:label="RepForge"
android:name="${applicationName}"
android:icon="@mipmap/ic_launcher"
- android:allowBackup="false">
+ android:allowBackup="false"
+ android:fullBackupContent="@xml/backup_rules"
+ android:dataExtractionRules="@xml/data_extraction_rules">Create res/xml/data_extraction_rules.xml:
<?xml version="1.0" encoding="utf-8"?>
<data-extraction-rules>
<cloud-backup>
<exclude domain="root" path="." />
<exclude domain="file" path="." />
<exclude domain="database" path="." />
<exclude domain="sharedpref" path="." />
<exclude domain="external" path="." />
</cloud-backup>
<device-transfer>
<exclude domain="root" path="." />
<exclude domain="file" path="." />
<exclude domain="database" path="." />
<exclude domain="sharedpref" path="." />
<exclude domain="external" path="." />
</device-transfer>
</data-extraction-rules>Create res/xml/backup_rules.xml:
<?xml version="1.0" encoding="utf-8"?>
<full-backup-content>
<exclude domain="root" path="." />
<exclude domain="file" path="." />
<exclude domain="database" path="." />
<exclude domain="sharedpref" path="." />
<exclude domain="external" path="." />
</full-backup-content>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@workout-logger/android/app/src/main/AndroidManifest.xml` around lines 5 - 6,
The manifest currently only sets android:allowBackup="false" which is
insufficient on Android 12+; update the <application> attributes to add
android:dataExtractionRules="@xml/data_extraction_rules" and
android:fullBackupContent="@xml/backup_rules", and add the two XML resources
(res/xml/data_extraction_rules.xml and res/xml/backup_rules.xml) containing
explicit exclude entries for root, file, database, sharedpref, and external
domains for both cloud-backup and device-transfer (data_extraction_rules) and
full-backup-content (backup_rules) so all data domains are excluded.
There was a problem hiding this comment.
@coderabbitai is there any specific reason why we are disabling backups?
There was a problem hiding this comment.
@Devasy, great question! Here are the key reasons why disabling android:allowBackup is a security best practice:
-
Sensitive data exposure: Android's Auto Backup (enabled by default) automatically uploads app data — including databases, shared preferences, and files — to the user's Google Drive. If that Google account is compromised, an attacker could restore the backup onto another device and access all of your app's stored data (e.g., workout history, user credentials, session tokens).
-
Unintended data retention: Even after a user uninstalls the app, backed-up data can persist in the cloud and be restored when the app is reinstalled, potentially on a different device. This creates unintended data retention that may conflict with privacy expectations.
-
ADB backup attack vector: On older Android versions,
allowBackup="true"also enables backup via ADB (adb backup), meaning anyone with physical USB access to an unlocked device could extract app data — a significant risk for apps handling personal health/fitness data. -
Google Play compliance: Google's Privacy and Security guidelines recommend explicitly controlling backup behavior for apps that handle personal or sensitive data.
For a workout logger storing personal health/fitness data, disabling backups is the right call. However, as my review comment noted, android:allowBackup="false" alone is not sufficient on Android 12+ — you also need android:dataExtractionRules to block device-to-device transfers, and android:fullBackupContent for Android 11 and below compatibility. The fix suggested in the review comment addresses all of these cases comprehensively.
There was a problem hiding this comment.
I can clarify this since I authored the change: We are disabling backups as a security measure to prevent potential data leakage. By default, Android automatically backs up application data to Google Drive, which could expose sensitive application data or user information if the user's backup account is compromised. Setting android:allowBackup="false" ensures that the app's data stays securely on the device.
There was a problem hiding this comment.
Skipped: comment is from another GitHub bot.
Co-authored-by: Devasy23 <110348311+Devasy23@users.noreply.github.com>
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
Co-authored-by: Devasy23 <110348311+Devasy23@users.noreply.github.com>
1 participant
🎯 What: Added android:allowBackup="false" to AndroidManifest.xml.
⚠️ Risk: By default, Android automatically backs up application data to Google Drive. This could expose sensitive application data or user info if the backup account is compromised, or lead to unintentional data retention.
🛡️ Solution: Setting allowBackup="false" disables this default behavior and ensures data stays on the device.
PR created automatically by Jules for task 2068063299429963149 started by @Devasy23
Summary by CodeRabbit