Lesson 2.16: Reviewing the Android manifest
The manifest decides what other apps and the system can do with an app. Every component marked exported can be started or queried by any app on the phone, so each one needs a reason and, where it handles data, a permission. Application flags matter too: debuggable must be off in a release, allowBackup decides whether app data can leave the phone in backups, and the network security configuration sets the rules for connections. In the lab you decode Northwind Shop 3.2.0, list its exported components, find a debug screen and a data provider open to every app, check its flags and permissions, and fix the source manifest.
17 min
You will learn to
- Explain exported components and their risk
- Find exported activities and providers
- Check debuggable, allowBackup and the network security config
- Question unnecessary permissions
- Fix a manifest in source
Key terms
- Component
- A building block the system can start: activity (screen), service, broadcast receiver, content provider.
- android:exported
- Whether other apps can start or query the component.
- Content provider
- A component that shares structured data through content:// URIs.
- allowBackup
- Allows the app's data to be included in device backups and transfers.
- android:debuggable
- Makes the app debuggable: run-as and debuggers work on it.
← Reading e-mail headers · All lessons · MAC addresses, Ethernet and ARP →