CODEWITHSUNDEEP
javaandroidapisecuritydropbox
Mark Harrop
Mark Harrop

Reputation: 202

How can i hide my dropbox api keys

Is there any way to make a dropbox API activity that I can call from other classes? I have a download section and instead of rewriting the code in every class could I put it in its own class then call that class when I need it?

Also is there a way to hide my dropbox API keys?

Here is how I have the API set up at the moment. There has to be a more secure way as I don't want my details on show.

public static String  APP_TYPE ="/FOLDER -- LOCATION-- FOR--DOWNLOADS";
public static String path = Environment.getExternalStorageDirectory().getAbsolutePath() + APP_TYPE;
public static File Dir = new File (path);
AndroidAuthSession session = buildSession();

static DropboxAPI<AndroidAuthSession> dropboxAPI;
private final String APP_KEY = "MY -- KEY";
private final String APP_ACCESS = "MY -- PASSWORD";
private final String TOKEN = "MY -- ACCESS -- TOKEN";

Then in my onCreate

  Dir.mkdir();

        dropboxAPI = new DropboxAPI<AndroidAuthSession>(session);

I call this with my on click command.

  DownloadFromDropboxFromPath(path + "downloadFileFromDropbox", +APP_TYPE +"MY.apk");

Finally this is the actual way I call the API.

 private AndroidAuthSession buildSession() {
    AppKeyPair appKeyPair = new AppKeyPair(APP_KEY, APP_ACCESS);
    AndroidAuthSession session = new AndroidAuthSession(appKeyPair);
    session.setOAuth2AccessToken(TOKEN);
    return session;
}

static final int UploadFromSelectApp = 9501;
static final int UploadFromFilemanager = 9502;
public static String DropboxUploadPathFrom = "";
public static String DropboxUploadName = "";
public static String DropboxDownloadPathFrom = "";
public static String DropboxDownloadPathTo = "";

private void UploadToDropboxFromPath(String uploadPathFrom, String uploadPathTo) {
    Toast.makeText(getApplicationContext(), "Upload file ...", Toast.LENGTH_SHORT).show();
    final String uploadPathF = uploadPathFrom;
    final String uploadPathT = uploadPathTo;
    Thread th = new Thread(new Runnable() {
        public void run() {
            File tmpFile = null;
            try {
                tmpFile = new File(uploadPathF);
            } catch (Exception e) {
                e.printStackTrace();
            }
            FileInputStream fis = null;
            try {
                fis = new FileInputStream(tmpFile);
            } catch (FileNotFoundException e) {
                e.printStackTrace();
            }
            try {
                dropboxAPI.putFileOverwrite(uploadPathT, fis, tmpFile.length(), null);
            } catch (Exception e) {
            }
            getMain().runOnUiThread(new Runnable() {
                @Override
                public void run() {
                    Toast.makeText(getApplicationContext(), "File successfully uploaded.", Toast.LENGTH_SHORT).show();
                }
            });
        }
    });
    th.start();
}

private void DownloadFromDropboxFromPath(String downloadPathTo, final String downloadPathFrom) {
    DropboxDownloadPathTo = downloadPathTo;
    DropboxDownloadPathFrom = downloadPathFrom;

    runOnUiThread(new Runnable() {
        @Override
        public void run() {

            Toast.makeText(getApplicationContext(), "Downloading  Please wait ...", Toast.LENGTH_LONG).show();
            Thread th = new Thread(new Runnable() {
                public void run() {
                    final File file = new File(DropboxDownloadPathTo + DropboxDownloadPathFrom.substring(DropboxDownloadPathFrom.lastIndexOf('.')));
                    if (file.exists()) file.delete();

                    try {
                        FileOutputStream outputStream = new FileOutputStream(file);
                        castingapplistview.dropboxAPI.getFile(DropboxDownloadPathFrom, null, outputStream, null);
                        getMain().runOnUiThread(new Runnable() {
                            @Override
                            public void run() {
                                Toast.makeText(getApplicationContext(), "File successfully downloaded.", Toast.LENGTH_SHORT).show();
                                showInterstitial();

                                Intent promptInstall = new Intent(Intent.ACTION_VIEW).setDataAndType(Uri.fromFile(file),
                                        "application/vnd.android.package-archive");
                                promptInstall.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);

                                startActivity(promptInstall);
                            }
                        });
                    } catch (Exception e) {
                        e.printStackTrace();
                    }

                }
            });
            th.start();
        }
    });
}

@Override
public void onActivityResult(int requestCode, int resultCode, Intent intent) {
    if (requestCode == UploadFromFilemanager) {
        final Uri currFileURI = intent.getData();
        final String pathFrom = currFileURI.getPath();
        Toast.makeText(getApplicationContext(), "Upload file ...", Toast.LENGTH_SHORT).show();
        Thread th = new Thread(new Runnable() {
            public void run() {
                getMain().runOnUiThread(new Runnable() {
                    @Override
                    public void run() {
                        UploadToDropboxFromPath(pathFrom, "/db-test/" + DropboxUploadName + pathFrom.substring(pathFrom.lastIndexOf('.')));
                        Toast.makeText(getApplicationContext(), "File successfully uploaded.", Toast.LENGTH_SHORT).show();
                    }
                });
            }
        });
        th.start();
    }
    if (requestCode == UploadFromSelectApp) {
        Toast.makeText(getApplicationContext(), "Upload file ...", Toast.LENGTH_SHORT).show();
        final Uri uri = intent.getData();

        DropboxUploadPathFrom = getPath(getApplicationContext(), uri);
        if (DropboxUploadPathFrom == null) {
            DropboxUploadPathFrom = uri.getPath();
        }
        Thread th = new Thread(new Runnable() {
            public void run() {
                try {
                    final File file = new File(DropboxUploadPathFrom);
                    InputStream inputStream = getContentResolver().openInputStream(uri);

                    dropboxAPI.putFile("/db-test/" + DropboxUploadName + file.getName().substring(file.getName().lastIndexOf("."),
                            file.getName().length()), inputStream, file.length(), null, new ProgressListener() {
                        @Override
                        public long progressInterval() {
                            return 100;
                        }

                        @Override
                        public void onProgress(long arg0, long arg1) {
                        }
                    });
                    getMain().runOnUiThread(new Runnable() {
                        @Override
                        public void run() {
                            Toast.makeText(getApplicationContext(), "File successfully uploaded.", Toast.LENGTH_SHORT).show();
                        }
                    });
                } catch (Exception e) {
                    e.printStackTrace();
                }
            }
        });
        th.start();
    }
    super.onActivityResult(requestCode, resultCode, intent);
}

public String getPath(Context context, Uri contentUri) {
    Cursor cursor = null;
    try {
        String[] proj = {MediaStore.Images.Media.DATA, MediaStore.Video.Media.DATA, MediaStore.Audio.Media.DATA};
        cursor = context.getContentResolver().query(contentUri, proj, null, null, null);
        int column_index = cursor.getColumnIndexOrThrow(MediaStore.Images.Media.DATA);
        cursor.moveToFirst();
        String s = cursor.getString(column_index);
        if (s != null) {
            cursor.close();
            return s;
        }
    } catch (Exception e) {
    }
    try {
        int column_index = cursor.getColumnIndexOrThrow(MediaStore.Video.Media.DATA);
        cursor.moveToFirst();
        String s = cursor.getString(column_index);
        if (s != null) {
            cursor.close();
            return s;
        }
    } catch (Exception e) {
    }
    try {
        int column_index = cursor.getColumnIndexOrThrow(MediaStore.Audio.Media.DATA);
        cursor.moveToFirst();
        String s = cursor.getString(column_index);
        cursor.close();
        return s;
    } finally {
        if (cursor != null) {
            cursor.close();
        }
    }
}

public castingapplistview getMain() {
    return this;
        }

    }

At the moment I have all this code in every activity that uses the dropbox API. Surely I can make it in to its own class making sure to hide my keys? Thanks as always.

Upvotes: 1

Views: 316

Answers (2)

WIllJBD
WIllJBD

Reputation: 6154

The answer is no. There is no way to perfectly hide your keys in your app. You can hide them from a repository, but it is much more difficult to hide from someone who has your .apk file. Some one determined enough, will get them. That being said there are a number of ways to make it difficult, including using the NDK, and JNI, to have a function that will return your key given the application calling provides the correct application signatures, you can do more than just obfuscate c/c++ code.

Anyone that can decompile you app, which is anyone, can get your key. Putting it in gradle files, won't make it secure from people that want it. It gets compiled into a java class, which even when obfuscated, can be found.

Here is a decent article to guide you on your way.

http://www.informit.com/articles/article.aspx?p=2268753&seqNum=4

Upvotes: 2

Leonardo Sibela
Leonardo Sibela

Reputation: 2189

Is there any way to make a dropbox API activity that I can call from other classes? I have a download section and instead of rewriting the code in every class could I put it in its own class then call that class when I need it?

Yes. You can make a super class with those constants and extends whenever you need.

Also is there a way to hide my dropbox API keys?

Yes, you can put them in your build.gradle (module:app)

android {
    ...

    defaultConfig {
        ...
    }

    buildTypes {
        release {
        ...
    }

    buildTypes.each {
        it.buildConfigField 'String', 'MY_API_TOKEN_KEY', MyApiTokenValue
    }
}

And to use them on your activities (or any Java class), just use:

BuildConfig.MY_API_TOKEN_KEY

You can see it working on this repository.

Upvotes: 1

Related Questions