This commit addresses issue #257 (SEC-04) where `allowBackup="true"` was enabled but the extraction rules files had empty templates, exposing sensitive database and shared preferences files.
Changes made:
- Updated `AndroidManifest.xml` to include `android:dataExtractionRules` and `android:fullBackupContent` on the `<application>` element.
- Updated `res/xml/backup_rules.xml` and `res/xml/data_extraction_rules.xml` to specifically exclude the Room database (`hermes_control.db`) and EncryptedSharedPreferences file (`hermes_secure_prefs.xml`) from both cloud backup and device transfer operations.
Reasoning:
This prevents extraction of these sensitive files via `adb backup` or Google cloud backups on both legacy and API 31+ devices, mitigating a high-severity security vulnerability without breaking legitimate application backup capabilities.
Impact:
This secures the sensitive app data. No functional changes to the codebase logic were made.
Fixes#257
M57
2c52263772