Don't let the imported SDK and third-party libraries cause your app to be taken down!

Perhaps your application is using some third-party SDK or code base, after all, "standing on the shoulders of giants" saves time than the most basic application development from scratch. As an application developer, you are responsible for the overall situation of the application, including the user experience and your code. Of course, it also includes third-party SDKs and code libraries.

When you are considering using SDKs or code libraries, knowing them is particularly important for how to process and use data processing, which will allow you to better protect user privacy.

In this article, I will share with you several tools that can be used in different stages of application development, including the development stage and after the application is released (this is a supplement to the SDK manufacturer's documentation, and it is recommended that you read the SDK documentation carefully).

Merged Manifest view

In order to increase flexibility, Gradle supports multiple separate Android Manifest files defined by application build configuration, application module or code base dependent requirements. These manifest files contain different default XML elements and attributes according to the needs of the project. When building the application, Gradle merges all manifest files into one manifest file. You can specify "merger rule" to define the value of the merger. Next, we discuss how to use this tool to gain insight into the SDK you rely on.

Android Studio provides an easy way to check the final merged manifest file. The method is to click on the "Merged Manifest" tab at the bottom of the manifest file editing window. Through the different colors highlighted on the interface, you can clearly distinguish different manifest file sources ( Manifest Sources ). These sources include different code base dependencies. For example, the following figure shows the permissions used by the dependency named "transport-backend" in the application.

Merged Manifest view example

Such a display effect can help you quickly locate abnormal permission requests caused by application dependencies. Because the permission request dialog box at runtime may change the user's interaction, the analysis data is not only very useful, but also enables you to more fully grasp the application's dependence on the purpose of using the data. If necessary, you need to explain to users when and why you want to access certain data.

If you see any abnormal permission usage in the merged manifest file, please carefully review the relevant dependency library documentation (or contact the developer) and make sure you understand the actual purpose of the permission usage.

This permission is likely to be optional for the service you are using. For scenarios that need to minimize data usage, you can add a "remove" node tag to the manifest file of the application module to prevent the permission request of the library from being merged into the final application.

<uses-permission android:name="SOME_PERMISSION"
   tools:node="remove"/>

Module dependency view

Another very useful tool in the development tool chain is Gradle's module dependency support. The usual usage of relying on graphs is to locate problems encountered during the build process. The dependency graph can also display indirect dependency information, which helps developers to know the additional dependencies introduced by the dependency library. For more information, please refer to: View module dependencies .

Next, we will introduce another tool that can help you better understand the data access in the application.

Data access audit

With the increase in application complexity (including the continuous expansion of your team), it is difficult to visually check the access to the SDK-related private data during the application development process.

Android 11 introduces the data access audit , which can help developers confirm which piece of code accesses the data during application use. This feature allows you to associate private data with business scenarios in the application, such as "order coffee" or "share with friends". Then locate any abnormal data access operations, and determine which module or application scenario performed the access operation.

To use this feature, first create a context object and associate it with an "attribute tag", which is related to a certain business scenario, such as "order coffee". You can implement these in the OrderCoffeeActivity.onCreate() method.

attributionContext = createAttributionContext("orderCoffee")

You can use the attributeContext created above as a Context type parameter in subsequent API calls of the development framework.

Next, set up a callback, which will be called when the private data is accessed. Inside the callback, you can get the attributeTag (attribution tag set above), and extract stack information or integrate your own application analysis methods.

val appOpsCallback = object : AppOpsManager.OnOpNotedCallback() {
      // 当您的应用访问了隐私数据的时候，该回调会在应用访问隐私数据的时候被调用
      // 比如联系人数据
      override fun onNoted(syncNotedAppOp: SyncNotedAppOp) {
        logDataAccess(syncNotedAppOp.op,
                 // 这里会返回上面创建 attributionContext 的时候所传入的标签字符串，
                // 比如，这里就是 “orderCoffee”
                syncNotedAppOp.attributionTag, 
                Throwable().stackTrace.toString())
    }

Data access audit supports both synchronous and asynchronous API calls, and can be used on Android 11 and later devices. For more information, please refer to: Data Access Audit .

Summary

The newly added Merged Manifest tool in Android 11, Gradle's support for module dependencies, and data access audit APIs are all designed to help developers provide additional monitoring for data access and operations that are dependent on in-app and SDK. So that you can show better transparency to end users. It is recommended that you integrate these tools into your existing workflow.

In addition, if you publish the application through the Google Play store, please make sure that you have read the relevant user data policy and make sure that the SDK you are using meets the requirements.