mirror of
https://github.com/android-password-store/Android-Password-Store
synced 2025-09-01 14:55:19 +00:00
fix(autofill-parser): reformat top-level comment
This commit is contained in:
@@ -14,42 +14,42 @@ import android.provider.Settings
|
|||||||
import android.service.autofill.SaveInfo
|
import android.service.autofill.SaveInfo
|
||||||
import androidx.annotation.RequiresApi
|
import androidx.annotation.RequiresApi
|
||||||
|
|
||||||
/*
|
/**
|
||||||
In order to add a new browser, do the following:
|
* In order to add a new browser, do the following:
|
||||||
|
*
|
||||||
1. Obtain the .apk from a trusted source. For example, download it from the Play Store on your
|
* 1. Obtain the .apk from a trusted source. For example, download it from the Play Store on your
|
||||||
phone and use adb pull to get it onto your computer. We will assume that it is called
|
* phone and use adb pull to get it onto your computer. We will assume that it is called
|
||||||
browser.apk.
|
* browser.apk.
|
||||||
|
*
|
||||||
2. Run
|
* 2. Run
|
||||||
|
*
|
||||||
aapt dump badging browser.apk | grep package: | grep -Eo " name='[a-zA-Z0-9_\.]*" | cut -c8-
|
* aapt dump badging browser.apk | grep package: | grep -Eo " name='[a-zA-Z0-9_\.]*" | cut -c8-
|
||||||
|
*
|
||||||
to obtain the package name (actually, the application ID) of the app in the .apk.
|
* to obtain the package name (actually, the application ID) of the app in the .apk.
|
||||||
|
*
|
||||||
3. Run
|
* 3. Run
|
||||||
|
*
|
||||||
apksigner verify --print-certs browser.apk | grep "#1 certificate SHA-256" | grep -Eo "[a-f0-9]{64}" | tr -d '\n' | xxd -r -p | base64
|
* apksigner verify --print-certs browser.apk | grep "#1 certificate SHA-256" | grep -Eo
|
||||||
|
* "[a-f0-9]{64}" | tr -d '\n' | xxd -r -p | base64
|
||||||
to calculate the hash of browser.apk's first signing certificate.
|
*
|
||||||
Note: This will only work if the apk has a single signing certificate. Apps with multiple
|
* to calculate the hash of browser.apk's first signing certificate. Note: This will only work if
|
||||||
signers are very rare, so there is probably no need to add them.
|
* the apk has a single signing certificate. Apps with multiple signers are very rare, so there is
|
||||||
Refer to computeCertificatesHash to learn how the hash would be computed in this case.
|
* probably no need to add them. Refer to computeCertificatesHash to learn how the hash would be
|
||||||
|
* computed in this case.
|
||||||
4. Verify the package name and the hash, for example by asking other people to repeat the steps
|
*
|
||||||
above.
|
* 4. Verify the package name and the hash, for example by asking other people to repeat the steps
|
||||||
|
* above.
|
||||||
5. Add an entry with the browser apps's package name and the hash to
|
*
|
||||||
TRUSTED_BROWSER_CERTIFICATE_HASH.
|
* 5. Add an entry with the browser apps's package name and the hash to
|
||||||
|
* TRUSTED_BROWSER_CERTIFICATE_HASH.
|
||||||
6. Optionally, try adding the browser's package name to BROWSERS_WITH_SAVE_SUPPORT and check
|
*
|
||||||
whether a save request to Password Store is triggered when you submit a registration form.
|
* 6. Optionally, try adding the browser's package name to BROWSERS_WITH_SAVE_SUPPORT and check
|
||||||
|
* whether a save request to Password Store is triggered when you submit a registration form.
|
||||||
7. Optionally, try adding the browser's package name to BROWSERS_WITH_MULTI_ORIGIN_SUPPORT and
|
*
|
||||||
check whether it correctly distinguishes web origins even if iframes are present on the page.
|
* 7. Optionally, try adding the browser's package name to BROWSERS_WITH_MULTI_ORIGIN_SUPPORT and
|
||||||
You can use https://fabianhenneke.github.io/Android-Password-Store/ as a test form.
|
* check whether it correctly distinguishes web origins even if iframes are present on the page. You
|
||||||
*/
|
* can use https://fabianhenneke.github.io/Android-Password-Store/ as a test form.
|
||||||
/*
|
*
|
||||||
* **Security assumption**: Browsers on this list correctly report the web origin of the top-level
|
* **Security assumption**: Browsers on this list correctly report the web origin of the top-level
|
||||||
* window as part of their AssistStructure.
|
* window as part of their AssistStructure.
|
||||||
*
|
*
|
||||||
|
Reference in New Issue
Block a user