Security issue: DevSettings Screen available in release react native android app.

[MateuszMatyska]

Vulnerability category: Misconfiguration

DevSettings activity is available on release react native android application. DevSettings in release flavour of react native android application could make security vulnerability. DevSettings activity from React Native 0.64 should be in android/app/src/debug/AndroidManifest.xml.
Link to latest Android Manifest in react-native-code-push
https://github.com/microsoft/react-native-code-push/blob/master/android/app/src/main/AndroidManifest.xml#L7
More Information under these links:
react/react-native@d8e6c45
https://react-native-community.github.io/upgrade-helper/?from=0.63.4&to=0.64.0
DevSettings should no be available in release application.

Steps to Reproduce

1. Do reverse engineering on android application code
2. Check Android Manifest file.
3. There is a DevSettings activity

Step to reproduce

1. Run application with objection
2. Hook all available activities
3. Invoke DevSettings activity

Step to reproduce

1. Run DevSettings activity with adb

Expected Behavior

DevSettings should not be available on release react native android application.

Actual Behavior

DevSettings should is available on release react native android application.

Environment

• react-native-code-push version: 7.0.4
• react-native version: 0.68.0
• iOS/Android/Windows version: Android
• Does this reproduce on a debug build or release build? Release
• Does this reproduce on a simulator, or only on a physical device? Device

This issue has been automatically marked as stale because it has not had any activity for 60 days. It will be closed if no further activity occurs within 15 days of this comment.

This issue will now be closed because it hasn't had any activity for 15 days after stale. Please feel free to open a new issue if you still have a question/issue or suggestion.