Getting Security Issues in Android Signed apk

[ritumobicules]

Environment

OS: macOS High Sierra 10.13.4
Node: 10.1.0
Yarn: Not Found
npm: 5.6.0
Watchman: 4.9.0
Xcode: Xcode 9.3.1 Build version 9E501
Android Studio: 3.2 AI-181.5540.7.32.5014246

Packages: (wanted => installed)
react: 16.3.1 => 16.3.1
react-native: 0.55.4 => 0.55.4

Description

We are using the tool Codified Security to find out the security issues in the signed apk and we are getting the following security issues:

1. App creates a temp file :
You need to fix this because:

Sensitive data might be written into a temp file.
You can fix this by changing this in your code.

Avoid creating temp files.
Common Weakness Enumeration

CWE-295 — The software does not validate, or incorrectly validates, a
certificate.

Problem has been found in:
com/facebook/cache/disk/DefaultDiskStorage.java
try { paramString = new InserterImpl(paramString, paramObject.createTempFile(localFile)); return paramString; localStringBuilder.append(resourceId); localStringBuilder.append("."); return File.createTempFile(localStringBuilder.toString(), ".tmp", paramFile); }

com/facebook/react/modules/camera/ImageEditingManager.java

paramContext = localFile; } return File.createTempFile("ReactNative_cropped_image_", getFileExtensionForType(paramString), paramContext); } if ((localObject != null) && (! ((String)localObject).isEmpty())) { File localFile = ImageEditingManager.createTempFile(mContext, (String)localObject); ImageEditingManager.writeCompressedBitmapToFile(paramVarArgs, (String)localObject, localFile);
com/google/android/gms/common/data/BitmapTeleporter.java
try { localFile = File.createTempFile("teleporter", ".tmp", zali); }

2. TCP socket usage detected

You need to fix this because:
TCP sockets need to be encrypted otherwise it may be vulnerable to the following attack mechanisms: DoS attacks, replay attacks, man in the middle (MITM) attacks, eavesdropping and subsequent impersonation. It's highly recommended to use TLS or other methods to secure your connection.
Common Weakness Enumeration
CWE-941 — The software creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.
More information can be seen on the CWE website
# PCI compliance.
This app may be in breach of PCI-DSS 2.2.3, 2.3 and 4.1.
SSL and early TLS (versions lower than 1.2) are not considered strong cryptography.
HIPAA compliance.
Transmission Security
This app may be in breach of HIPAA encryption requirements.
SSL and early TLS (versions lower than 1.2) are not considered strong cryptography.
GDPR compliance.
This app may be in breach of GDPR encryption requirements.
SSL and early TLS (versions lower than 1.2) are not considered strong cryptography.
OWASP compliance.
OWASP M3: Insufficient Transport Layer Protection
This app may be in breach of OWASP encryption requirements.

SSL and early TLS (versions lower than 1.2) are not considered strong cryptography.
Problem has been found in:
okio/Okio.java

import java.io.InterruptedIOException; import java.io.OutputStream;
import java.net.Socket;
  import java.net.SocketTimeoutException;

okhttp3/Connection.java

package okhttp3; import java.net.Socket;

okhttp3/ConnectionPool.java

import java.lang.ref.Reference; import java.net.Socket; 
import java.util.ArrayDeque;

okhttp3/OkHttpClient.java

import java.net.Proxy;
import java.net.ProxySelector; import java.net.Socket;
import java.net.UnknownHostException

okhttp3/interal/Internal.java

import java.net.MalformedURLException; 
import java.net.Socket;
import java.net.UnknownHostException;

okhttp3/internal/Util.java

import java.lang.reflect.Array; import java.net.IDN;
import java.net.ServerSocket;
import java.net.Socket;
import java.net.IDN;
import java.net.ServerSocket;
import java.net.Socket;
import java.nio.charset.Charset;

okhttp3/internal/connection/RealConnection.java

import java.net.Proxy; import java.net.Proxy.Type; 
import java.net.Socket;
import java.net.SocketException

Object localObject2 = route.address();
 if ((((Proxy)localObject1).type() != Proxy.Type.DIRECT)
  && (((Proxy)localObject1).type() != Proxy.Type.HTTP)) {
localObject1 = new Socket((Proxy)localObject1);
} else {

okhttp3/internal/connection/StreamAllocation.java

import java.lang.ref.Reference; 
import java.lang.ref.WeakReference; 
import java.net.Socket;
import java.util.List;

okhttp3/internal/http2/Http2Connection.java

import java.io.IOException;
import java.net.InetSocketAddress; 
import java.net.Socket;
import java.util.Collection;

okhttp3/internal/platform/AndroidPlatform.java

import java.lang.reflect.Method; 
import java.net.InetSocketAddress; 
import java.net.Socket;
import java.security.cert.Certificate;

okhttp3/internal/platform/Platform.java

import java.lang.reflect.Field; 
import java.net.InetSocketAddress; 
import java.net.Socket;
import java.util.ArrayList;

okhttp3/internal/ws/RealWebSocket.java

import java.io.IOException;
import java.net.ProtocolException; 
import java.net.Socket;
import java.util.ArrayDeque;

com/facebook/react/modules/network/TLSSocketFactory.java

import java.io.IOException; 
import java.net.InetAddress; 
import java.net.Socket; 
import java.net.UnknownHostException;

Please suggest how we can resolve these issues.

Thanks

[react-native-bot]

Can you run react-native info and edit your issue to include these results under the Environment section?

If you believe this information is irrelevant to the reported issue, you may write [skip envinfo] under Environment to let us know.

[react-native-bot]

It looks like you are using an older version of React Native. Please update to the latest release, v0.57 and verify if the issue still exists.

The "⏪Old Version" label will be removed automatically once you edit your original post with the results of running react-native info on a project using the latest release.

[ritumobicules]

We are using react-native version 0.55.4. It is not the solution to update react-native version. It is not too old. It should work on 0.55.4 version too.

[hramos]

The reason behind asking bug reports to use the latest version is to verify this is an issue that is not yet fixed in the latest release. If this cannot be replicated on 0.57, the issue will be closed.

[breadadams]

Sure @hramos, we're updating RN and will get back to you 👍

[ferrannp]

Hello there 👋 this issue has been reported for an old version of React Native. Ideally we'd like everyone to be using 0.59 (see the awesome changes it brought) but we know updating can be a pain. We are going to close this issue because it's from a version before 0.57, which is really old.

But please, if it's actually still an issue with 0.59 please comment below and we can reopen it 😊

[breadadams]

Darn, totally forgot to reply! After updating React-native (to 0.58.x) the issue went away (as there were specific updates to okhttp around TLS, one of the main culprits of the warnings).

[mazenchami]

@ferrannp when i try to run my project in the simulator, no issues (except for some known warning messages).
when i try to archive the project, i get the following error: AppDelegate.m:13:9: fatal error: 'React/RCTLog.h' file not found and also other 'React/RCT*.h' errors.

Info

React Native Environment Info:
System:
OS: macOS 10.14.4
CPU: (8) x64 Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz
Memory: 705.62 MB / 16.00 GB
Shell: 3.2.57 - /bin/bash
Binaries:
Node: 10.4.1 - ~/.nvm/versions/node/v10.4.1/bin/node
Yarn: 1.7.0 - /usr/local/bin/yarn
npm: 6.4.1 - ~/.nvm/versions/node/v10.4.1/bin/npm
Watchman: 4.9.0 - /usr/local/bin/watchman
SDKs:
iOS SDK:
Platforms: iOS 12.2, macOS 10.14, tvOS 12.2, watchOS 5.2
Android SDK:
API Levels: 23, 24, 25, 26, 27, 28
Build Tools: 23.0.1, 25.0.0, 25.0.2, 25.0.3, 26.0.2, 27.0.3, 28.0.3
System Images: android-25 | Google APIs Intel x86 Atom, android-28 | Google Play Intel x86 Atom
IDEs:
Android Studio: 3.3 AI-182.5107.16.33.5314842
Xcode: 10.2/10E125 - /usr/bin/xcodebuild
npmPackages:
react: 16.8.3 => 16.8.3
react-native: 0.59.3 => 0.59.3
npmGlobalPackages:
create-react-native-app: 2.0.2
react-native-create-library: 3.1.2
react-native-git-upgrade: 0.2.7