[Bug]: Package collects AD_ID

[opxdelwin]

Platform

emulator

Plugin

share_plus

Version

^7.1.0

Flutter SDK

3.0.6

Steps to reproduce

• Use the package in your app
• Create a release build
• Navigate to build\app\intermediates\merged_manifest\release\AndroidManifest.xml, see that permission com.google.android.gms.permission.AD_ID was added.
• Navigate to build\app\outputs\logs\manifest-merger-profile-report.txt to find that permission was added by share_plus.

Code Sample

Not required. Flutter boilerplate with `share_plus` dependency would cause this permission to be added on `release` build

Logs

NA

Flutter Doctor

[√] Flutter (Channel master, 3.18.0-11.0.pre.94, on Microsoft Windows [Version 10.0.19045.3803], locale en-IN)
    • Flutter version 3.18.0-11.0.pre.94 on channel master at C:\src\flutter
    • Upstream repository https://github.com/opxdelwin/flutter.git
    • FLUTTER_GIT_URL = https://github.com/opxdelwin/flutter.git
    • Framework revision 7bacc5613a (11 days ago), 2023-12-16 17:24:07 -0500
    • Engine revision 726a137e3f
    • Dart version 3.3.0 (build 3.3.0-238.0.dev)
    • DevTools version 2.31.0-dev.0

[√] Windows Version (Installed version of Windows is version 10 or higher)

[√] Android toolchain - develop for Android devices (Android SDK version 34.0.0)
    • Android SDK at C:\Users\delu8\AppData\Local\Android\sdk
    • Platform android-34, build-tools 34.0.0
    • Java binary at: C:\Program Files\Android\Android Studio\jbr\bin\java
    • Java version OpenJDK Runtime Environment (build 17.0.7+0-b2043.56-10550314)
    • All Android licenses accepted.

[√] Chrome - develop for the web
    • Chrome at C:\Program Files\Google\Chrome\Application\chrome.exe

[√] Visual Studio - develop Windows apps (Visual Studio Community 2022 17.8.3)
    • Visual Studio at C:\Program Files\Microsoft Visual Studio\2022\Community
    • Visual Studio Community 2022 version 17.8.34330.188
    • Windows 10 SDK version 10.0.22621.0

[√] Android Studio (version 2023.1)
    • Android Studio at C:\Program Files\Android\Android Studio
    • Flutter plugin can be installed from:
       https://plugins.jetbrains.com/plugin/9212-flutter
    • Dart plugin can be installed from:
       https://plugins.jetbrains.com/plugin/6351-dart
    • Java version OpenJDK Runtime Environment (build 17.0.7+0-b2043.56-10550314)

[√] VS Code (version 1.85.1)
    • VS Code at C:\Users\delu8\AppData\Local\Programs\Microsoft VS Code
    • Flutter extension version 3.80.0

[√] Connected device (4 available)
    • sdk gphone64 x86 64 (mobile) • emulator-5554 • android-x64    • Android 14 (API 34) (emulator)
    • Windows (desktop)            • windows       • windows-x64    • Microsoft Windows [Version 10.0.19045.3803]
    • Chrome (web)                 • chrome        • web-javascript • Google Chrome 120.0.6099.110
    • Edge (web)                   • edge          • web-javascript • Microsoft Edge 120.0.2210.91

[√] Network resources
    • All expected network resources are available.

• No issues found!

Checklist before submitting a bug

• I searched issues in this repository and couldn't find such bug/problem
• I Google'd a solution and I couldn't find it
• I searched on StackOverflow for a solution and I couldn't find it
• I read the README.md file of the plugin
• I'm using the latest version of the plugin
• All dependencies are up to date with flutter pub upgrade
• I did a flutter clean
• I tried running the example project

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 15 days

[miquelbeltran]

I cannot reproduce this with the example project, this is my merged manifest in the example app:

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="io.flutter.plugins.shareexample"
    android:versionCode="1"
    android:versionName="1.0" >

    <uses-sdk
        android:minSdkVersion="19"
        android:targetSdkVersion="34" />

    <uses-permission android:name="android.permission.INTERNET" />

    <permission
        android:name="io.flutter.plugins.shareexample.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
        android:protectionLevel="signature" />

    <uses-permission android:name="io.flutter.plugins.shareexample.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION" />

    <application
        android:name="android.app.Application"
        android:appComponentFactory="androidx.core.app.CoreComponentFactory"
        android:debuggable="true"
        android:extractNativeLibs="true"
        android:icon="@mipmap/ic_launcher"
        android:label="share_example" >
        <activity
            android:name="io.flutter.embedding.android.FlutterActivity"
            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|locale|layoutDirection"
            android:exported="true"
            android:hardwareAccelerated="true"
            android:theme="@android:style/Theme.Black.NoTitleBar"
            android:windowSoftInputMode="adjustResize" >
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>

        <meta-data
            android:name="flutterEmbedding"
            android:value="2" />

        <provider
            android:name="io.flutter.plugins.imagepicker.ImagePickerFileProvider"
            android:authorities="io.flutter.plugins.shareexample.flutter.image_provider"
            android:exported="false"
            android:grantUriPermissions="true" >
            <meta-data
                android:name="android.support.FILE_PROVIDER_PATHS"
                android:resource="@xml/flutter_image_picker_file_paths" />
        </provider>
        <!--
           Declares a provider which allows us to store files to share in
           '.../caches/share_plus' and grant the receiving action access
        -->
        <provider
            android:name="dev.fluttercommunity.plus.share.ShareFileProvider"
            android:authorities="io.flutter.plugins.shareexample.flutter.share_provider"
            android:exported="false"
            android:grantUriPermissions="true" >
            <meta-data
                android:name="android.support.FILE_PROVIDER_PATHS"
                android:resource="@xml/flutter_share_file_paths" />
        </provider>
        <!--
           This manifest declared broadcast receiver allows us to use an explicit
           Intent when creating a PendingItent to be informed of the user's choice
        -->
        <receiver
            android:name="dev.fluttercommunity.plus.share.SharePlusPendingIntent"
            android:exported="false" >
            <intent-filter>
                <action android:name="EXTRA_CHOSEN_COMPONENT" />
            </intent-filter>
        </receiver>

        <uses-library
            android:name="androidx.window.extensions"
            android:required="false" />
        <uses-library
            android:name="androidx.window.sidecar"
            android:required="false" />

        <provider
            android:name="androidx.startup.InitializationProvider"
            android:authorities="io.flutter.plugins.shareexample.androidx-startup"
            android:exported="false" >
            <meta-data
                android:name="androidx.profileinstaller.ProfileInstallerInitializer"
                android:value="androidx.startup" />
        </provider>

        <receiver
            android:name="androidx.profileinstaller.ProfileInstallReceiver"
            android:directBootAware="false"
            android:enabled="true"
            android:exported="true"
            android:permission="android.permission.DUMP" >
            <intent-filter>
                <action android:name="androidx.profileinstaller.action.INSTALL_PROFILE" />
            </intent-filter>
            <intent-filter>
                <action android:name="androidx.profileinstaller.action.SKIP_FILE" />
            </intent-filter>
            <intent-filter>
                <action android:name="androidx.profileinstaller.action.SAVE_PROFILE" />
            </intent-filter>
            <intent-filter>
                <action android:name="androidx.profileinstaller.action.BENCHMARK_OPERATION" />
            </intent-filter>
        </receiver>
    </application>

</manifest>

Also, no AD_ID is found in the packages/share_plus/share_plus/example/build/app/outputs/logs/manifest-merger-debug-report.txt file.

Are you sure you are talking about share_plus? Can you try with the latest plugin release?

Besides, I fail to understand how share_plus could add that permission, except if there is some kind of malicious dependency in pub.dev or similar. Overall this is very strange.