Skip to content

fix: let an empty setActivationMethods list turn the activation methods off - #48

Open
boehlerlukas wants to merge 1 commit into
mainfrom
fix/hc-audit-findings
Open

boehlerlukas wants to merge 1 commit into
mainfrom
fix/hc-audit-findings

Conversation

@boehlerlukas

Copy link
Copy Markdown
Contributor

What this fixes

Help-center audit finding 25: Flutter apps could not turn the activation methods off from code.

Gleap.setActivationMethods(activationMethods: []) passed an empty array to the native SDKs, and both read an empty array as "use the dashboard settings":

  • iOS: GleapActivationMethodHelper useAutoActivationMethods is true while the list is empty, so GleapConfigHelper fills it from activationMethodShake / activationMethodScreenshotGesture.
  • Android: an empty prioritized list falls back to the config's methods the next time the config loads (GleapDetectorUtil.initDetectors).

Both native SDKs treat NONE on its own as "none". The iOS and Android bridges now send NONE when the list is empty, so [] means no shake and no screenshot gesture. The dartdoc says so. This needs no native SDK change and works with the 19.3.0 natives.

Verified

  • flutter analyze lib: No issues found.
  • flutter test: All tests passed (21).
  • flutter build apk --debug (example): built, so the Android bridge compiles against gleap-android-sdk 19.3.0.
  • flutter build ios --simulator --debug --no-codesign (example) fails here with an uncategorized Xcode error (exit 255). It fails the same way with this PR's iOS change reverted, so it is the local Xcode 27 toolchain, not this change. The iOS change is 3 lines using the existing NONE enum value.
  • Not run on a device.

Not fixed (needs decision / out of scope)

  • Flutter has no maskView API (finding 26 is fixed natively in Gleap-iOS-SDK#60 and Android-SDK#55). A Flutter-level mask (by widget key or rect) is a product decision.
  • No version bump or CHANGELOG entry (PR only).

🤖 Generated with Claude Code

…ds off

Gleap.setActivationMethods(activationMethods: []) passed an empty array to the
native SDKs, which read it as "use the dashboard settings" (iOS
GleapActivationMethodHelper useAutoActivationMethods, Android when the config
loads again). So shake / screenshot could not be turned off from code. The
bridges now pass NONE for an empty list, which both native SDKs treat as none.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant