1160872 - I can get the raw source code of any app installed using Firefox for Android

Status: RESOLVED WONTFIX

(Marketplace Graveyard :: General, defect)

Description

[r.gautamkrishna]

Attachment: screenshots.zip

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Build ID: 20150415140819

Steps to reproduce:

I just installed cot the rope application using the Firefox for android from the Firefox marketplace, I just created a backup of he cut the rope.apk and copied it to my computer.
I extracted it using 7zip


Actual results:

I found all the folders of the app's android runtime
i navigated to the \Cut The Rope\res\raw folder and found out the application.zip
Extracted that zip file, now i have the raw source code of the application, cut the rope,

Check out the screenshots attached


Expected results:

I think source code must not be shared to any users. If it is a security intense application, Hackers can easily make use of it.

Comment 1

[Stefan Freeston[MCWS]]]

the sorce code is openly avalible so there should be no issue as mozilla is opensouce ...

Comment 2

[Bill Walker [:bwalker] [@wfwalker]]

(In reply to r.gautamkrishna from comment #0)
> Created attachment 8600689 [details]
> screenshots.zip
> 
> User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101
> Firefox/37.0
> Build ID: 20150415140819
> 
> Steps to reproduce:
> 
> I just installed cot the rope application using the Firefox for android from
> the Firefox marketplace, I just created a backup of he cut the rope.apk and
> copied it to my computer.
> I extracted it using 7zip
> 
> 
> Actual results:
> 
> I found all the folders of the app's android runtime
> i navigated to the \Cut The Rope\res\raw folder and found out the
> application.zip
> Extracted that zip file, now i have the raw source code of the application,
> cut the rope,
> 
> Check out the screenshots attached
> 
> 
> Expected results:
> 
> I think source code must not be shared to any users. If it is a security
> intense application, Hackers can easily make use of it.

I would say this is similar to tools that allow one to decompile Android native Java apps, such as http://www.decompileandroid.com/. In other words, the Open Web Apps on Firefox Marketplace offer developers as much protection from prying eyes as native apps do. As with other ecosystems, security-intenstive applications must find ways to preserve security without fully trusting client software.

Comment 3

[Bill Walker [:bwalker] [@wfwalker]]

(In reply to stefancosten from comment #1)
> the sorce code is openly avalible so there should be no issue as mozilla is
> opensouce ...

Although Mozilla's software is always open source, this need not apply to all the applications available in the Firefox Marketplace.

Comment 4

[Myk Melez [:myk] [@mykmelez]]

(In reply to Bill Walker [:bwalker] [@wfwalker] from comment #2)
> I would say this is similar to tools that allow one to decompile Android
> native Java apps, such as http://www.decompileandroid.com/. In other words,
> the Open Web Apps on Firefox Marketplace offer developers as much protection
> from prying eyes as native apps do. As with other ecosystems,
> security-intenstive applications must find ways to preserve security without
> fully trusting client software.

That's correct.  Developers can obfuscate their code, and they can even write their app in C and compile it to asm.js to make it harder to decompile.  But they can't absolutely prevent users from seeing the code.

And we should let developers decide whether or not to obfuscate, especially since it isn't foolproof, and some developers (f.e. developers of open source software) would prefer to ship their software without it anyway.


In any case, this bug is not specific to Android, since APKs are just one way that Marketplace distributes app packages. You can also simply download the package directly from Marketplace.  For example, the current version of Cut The Rope is at:

  https://marketplace.firefox.com/downloads/file/265749/cut-the-rope-1.4.zip

So I'm moving this bug to Marketplace and recommend that we don't do anything here.