From 2c52263772248ee5484cfeb948d98d9123391926 Mon Sep 17 00:00:00 2001
From: M57 <41645758+Hy4ri@users.noreply.github.com>
Date: Tue, 23 Jun 2026 12:42:15 +0300
Subject: [PATCH] Fix data exposure via Android backup by adding proper
 exclusion rules (#339)

This commit addresses issue #257 (SEC-04) where `allowBackup="true"` was enabled but the extraction rules files had empty templates, exposing sensitive database and shared preferences files.

Changes made:
- Updated `AndroidManifest.xml` to include `android:dataExtractionRules` and `android:fullBackupContent` on the `<application>` element.
- Updated `res/xml/backup_rules.xml` and `res/xml/data_extraction_rules.xml` to specifically exclude the Room database (`hermes_control.db`) and EncryptedSharedPreferences file (`hermes_secure_prefs.xml`) from both cloud backup and device transfer operations.

Reasoning:
This prevents extraction of these sensitive files via `adb backup` or Google cloud backups on both legacy and API 31+ devices, mitigating a high-severity security vulnerability without breaking legitimate application backup capabilities.

Impact:
This secures the sensitive app data. No functional changes to the codebase logic were made.

Fixes #257
---
 app/src/main/AndroidManifest.xml               |  2 ++
 app/src/main/res/xml/backup_rules.xml          |  6 ++----
 app/src/main/res/xml/data_extraction_rules.xml | 12 ++++--------
 3 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 8b996e97..a4468923 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -10,6 +10,8 @@
     <application
         android:name=".HermesControlApp"
         android:allowBackup="true"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:fullBackupContent="@xml/backup_rules"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"
diff --git a/app/src/main/res/xml/backup_rules.xml b/app/src/main/res/xml/backup_rules.xml
index 4df92558..913e3a94 100644
--- a/app/src/main/res/xml/backup_rules.xml
+++ b/app/src/main/res/xml/backup_rules.xml
@@ -6,8 +6,6 @@
    See https://developer.android.com/about/versions/12/backup-restore
 -->
 <full-backup-content>
-    <!--
-   <include domain="sharedpref" path="."/>
-   <exclude domain="sharedpref" path="device.xml"/>
--->
+    <exclude domain="database" path="hermes_control.db" />
+    <exclude domain="sharedpref" path="hermes_secure_prefs.xml" />
 </full-backup-content>
\ No newline at end of file
diff --git a/app/src/main/res/xml/data_extraction_rules.xml b/app/src/main/res/xml/data_extraction_rules.xml
index 9ee9997b..5ab8d337 100644
--- a/app/src/main/res/xml/data_extraction_rules.xml
+++ b/app/src/main/res/xml/data_extraction_rules.xml
@@ -5,15 +5,11 @@
 -->
 <data-extraction-rules>
     <cloud-backup>
-        <!-- TODO: Use <include> and <exclude> to control what is backed up.
-        <include .../>
-        <exclude .../>
-        -->
+        <exclude domain="database" path="hermes_control.db" />
+        <exclude domain="sharedpref" path="hermes_secure_prefs.xml" />
     </cloud-backup>
-    <!--
     <device-transfer>
-        <include .../>
-        <exclude .../>
+        <exclude domain="database" path="hermes_control.db" />
+        <exclude domain="sharedpref" path="hermes_secure_prefs.xml" />
     </device-transfer>
-    -->
 </data-extraction-rules>
\ No newline at end of file