android.permission.WAKE_LOCK已自动启用

编程问答 2022-08-17

问题描述

我已经为Android和iOS开发了Flutter应用程序。它已由客户发送到安全审核。他们在审计中说android.permission.WAKE_LOCK已启用，并且存在安全风险。他们推荐了以下

建议考虑各自提供的每个功能 参数并评估启用该需求的业务需求。

好吧，我不知道此权限会带来安全风险，但是与此同时，我尚未在manifest文件中启用此权限。以下是我的Android清单

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.myapp.appname">
    <!-- io.Flutter.app.FlutterApplication is an android.app.Application that
         calls FlutterMain.startinitialization(this); in its onCreate method.
         In most cases you can leave this as-is,but you if you want to provide
         additional functionality it is fine to subclass or reimplement
         FlutterApplication and put your custom class here. -->
    <uses-permission android:name="android.permission.INTERNET"/>
    <application
        android:name="io.Flutter.app.FlutterApplication"
        android:label="MY APP"
        android:icon="@mipmap/launcher_icon">
        <activity
            android:name=".MainActivity"
            android:launchMode="singletop"
            android:theme="@style/LaunchTheme"
            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|smallestScreenSize|locale|layoutDirection|fontScale|screenLayout|density|uiMode"
            android:hardwareAccelerated="true"
            android:windowSoftInputMode="adjustResize">
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
            <intent-filter>
                <action android:name="FlutteR_NOTIFICATION_CLICK" />
                <category android:name="android.intent.category.DEFAULT" />
            </intent-filter>

        </activity>
        <!-- Don't delete the Meta-data below.
             This is used by the Flutter tool to generate GeneratedpluginRegistrant.java -->
        <Meta-data
            android:name="FlutterEmbedding"
            android:value="2" />
    </application>
</manifest>

下面是我的pubspecs.yaml文件

name: MyApp
description: A new Flutter project.

# The following defines the version and build number for your application.
# A version number is three numbers separated by dots,like 1.2.43
# followed by an optional build number separated by a +.
# Both the version and the builder number may be overridden in Flutter
# build by specifying --build-name and --build-number,respectively.
# In Android,build-name is used as versionName while build-number used as versionCode.
# Read more about Android versioning at https://developer.android.com/studio/publish/versioning
# In iOS,build-name is used as CFBundleShortVersionString while build-number used as CFBundLeversion.
# Read more about iOS versioning at
# https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
version: 1.0.2+3

environment:
  sdk: ">=2.1.0 <3.0.0"

dependencies:
  Flutter:
    sdk: Flutter

  # The following adds the Cupertino Icons font to your application.
  # Use with the CupertinoIcons class for iOS style icons.
  cupertino_icons: ^0.1.2
  google_fonts: ^0.2.0
  firebase_auth: ^0.14.0+5
  json_annotation: ^3.0.1
  provider: ^4.0.4
  badges: ^1.1.1
  firebase_messaging: ^6.0.13
  shared_preferences: ^0.5.6+3
  intl: ^0.16.1

dev_dependencies:
  Flutter_test:
    sdk: Flutter
  
  build_runner: ^1.7.4
  json_serializable: ^3.2.5
  Flutter_launcher_icons: "^0.7.3"

Flutter_icons:
  android: "launcher_icon"
  ios: true
  image_path: "assets/images/icon.jpg"


# For @R_363_4045@ion on the generic Dart part of this file,see the
# following page: https://dart.dev/tools/pub/pubspec

# The following section is specific to Flutter.
Flutter:

  # The following line ensures that the Material Icons font is
  # included with your application,so that you can use the icons in
  # the material Icons class.
  uses-material-design: true

  # To add assets to your application,add an assets section,like this:
  assets:
    - assets/images/logo.png
    - assets/images/lock_24px.png
    - assets/images/email_24px.png
    - assets/images/shopping_cart_48px.png
    - assets/images/logo_2.jpg
    - assets/images/fish1.png
    - assets/images/fish2.png
    - assets/icons/account-filled.png
    - assets/icons/account-not_filled.png
    - assets/icons/history-filled.png
    - assets/icons/history-not_filled.png
    - assets/icons/home-filled.png
    - assets/icons/home-not_filled.png
    - assets/icons/notifications-not_filled.png
    - assets/icons/notifications-filled.png
    - assets/images/loading_image2.gif

  # An image asset can refer to one or more resolution-specific "variants",see
  # https://Flutter.dev/assets-and-images/#resolution-aware.

  # For details regarding adding assets from package dependencies,see
  # https://Flutter.dev/assets-and-images/#from-packages

  # To add custom fonts to your application,add a fonts section here,# in this "Flutter" section. Each entry in this list should have a
  # "family" key with the font family name,and a "fonts" key with a
  # list giving the asset and other descriptors for the font. For
  # example:
  fonts:
    - family: Roboto
      fonts:
        - asset: fonts/Roboto-Regular.ttf
        - asset: fonts/Roboto-Medium.ttf
        - asset: fonts/Roboto-Bold.ttf
    - family: Ma Shan Zheng
      fonts:
        - asset: fonts/MaShanZheng-Regular.ttf
  #   - family: Trajan Pro
  #     fonts:
  #       - asset: fonts/TrajanPro.ttf
  #       - asset: fonts/TrajanPro_Bold.ttf
  #         weight: 700
  #
  # For details regarding fonts from package dependencies,# see https://Flutter.dev/custom-fonts/#from-packages

这是怎么回事？也许许可是由我使用的其中一个插件自动添加的？在这种情况下，如何将其删除？

解决方法

首先检查合并清单（检查哪个库添加了此权限）-将“文本”更改为“合并清单”。查看是否需要该库，如果需要，则可以认为第三方库正在使用它。 要删除它，请在清单中添加它：

<uses-permission
        android:name="android.permission.WAKE_LOCK"
        tools:node="remove" />
androidandroidandroid-permissionsdartflutter-dependencies