Skip to content

Commit 8a7ed4a

Browse files
committed
Fixed false positive FCM warning
* The "Google Play Console" > "Release Management" > "Pre-launch report" was showing the following error: ``` Your app contains exposed Google Cloud Platform (GCP) API keys. Please see this Google Help Center article for details. Vulnerable locations: com.onesignal.PushRegistratorFCM->getApiKey ``` * Used base64 encoding for the shared default base 64 key to avoid this false positive FCM warning - This is safe as it is a client side ApiKey required for FirebaseApp.initializeApp
1 parent 93c2426 commit 8a7ed4a

File tree

1 file changed

+9
-4
lines changed

1 file changed

+9
-4
lines changed

OneSignalSDK/onesignal/src/main/java/com/onesignal/PushRegistratorFCM.java

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@
3030
import android.content.ComponentName;
3131
import android.content.Context;
3232
import android.content.pm.PackageManager;
33+
import android.util.Base64;
34+
3335
import android.support.annotation.NonNull;
3436

3537
import com.google.firebase.FirebaseApp;
@@ -44,9 +46,12 @@
4446

4547
class PushRegistratorFCM extends PushRegistratorAbstractGoogle {
4648

47-
private static final String FCM_DEFAULT_PROJECT_ID = "onesignal-shared-public"; // project_info.project_id
48-
private static final String FCM_DEFAULT_APP_ID = "1:754795614042:android:c682b8144a8dd52bc1ad63"; // client.client_info.mobilesdk_app_id
49-
private static final String FCM_DEFAULT_API_KEY = "AIzaSyAnTLn5-_4Mc2a2P-dKUeE-aBtgyCrjlYU"; // client.api_key.current_key
49+
// project_info.project_id
50+
private static final String FCM_DEFAULT_PROJECT_ID = "onesignal-shared-public";
51+
// client.client_info.mobilesdk_app_id
52+
private static final String FCM_DEFAULT_APP_ID = "1:754795614042:android:c682b8144a8dd52bc1ad63";
53+
// client.api_key.current_key
54+
private static final String FCM_DEFAULT_API_KEY_BASE64 = "QUl6YVN5QW5UTG41LV80TWMyYTJQLWRLVWVFLWFCdGd5Q3JqbFlV";
5055

5156
private static final String FCM_APP_NAME = "ONESIGNAL_SDK_FCM_APP_NAME";
5257

@@ -113,7 +118,7 @@ private void initFirebaseApp(String senderId) {
113118
private static @NonNull String getApiKey() {
114119
if (OneSignal.remoteParams.fcmParams.apiKey != null)
115120
return OneSignal.remoteParams.fcmParams.apiKey;
116-
return FCM_DEFAULT_API_KEY;
121+
return new String(Base64.decode(FCM_DEFAULT_API_KEY_BASE64, Base64.DEFAULT));
117122
}
118123

119124
private static @NonNull String getProjectId() {

0 commit comments

Comments
 (0)