android-permission-detection-bugs

Files (1)

• SKILL.md

SKILL.md (first lines)

# Android Permission Detection Bugs

Common runtime bugs in Android apps that implement multi-step permission flows (RATs, spyware, monitoring apps, parental controls, accessibility tools). These bugs cause infinite permission request loops even when user has already granted the permission.

## When to Use This Skill

Trigger when:
- User reports "app stuck asking for permission even though it's enabled"
- Accessibility Service / Notification Listener / Device Admin permission loops
- Permission flow never advances to next step despite user enabling permission
- `checkSpecialPermissions()` keeps calling `startActivityForResult(Settings.ACTION_ACCESSIBILITY_SETTINGS)`
- Testing shows permission is ON but app detection returns false

## Bug #1: Accessibility Service Detection Loop

**Symptom:** App terus minta enable Accessibility Service padahal udah ON di Settings.

**Root Cause:** Simple `.contains()` check gagal handle Android's service name format variants.

### Broken Pattern (DO NOT USE)

```kotlin
private fun isAccessibilityServiceEnabled(): Boolean {
    val service = "${packageName}/.AppBlockerService"
    val enabledServices = Settings.Secure.getString(
        contentResolver,
        Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES
    )
    return enabledServices?.contains(service) == true
}
```

**Why it fails:**
- Android returns enabled services as **colon-separated string**: `com.app1/.Service:com.app2/.Service`
- Format bisa `com.sync.xxx/.AppBlockerService` (short form)
- OR `com.sync.xxx/com.sync.xxx.AppBlockerService` (full package path)
- `.contains()` only matches EXACT substring → fails on format variation
- User enables service → function still returns false → infinite loop

### Working Pattern (ALWAYS USE THIS)

```kotlin
private fun isAccessibilityServiceEnabled(): Boolean {
    val enabledServices = Settings.Secure.getString(
        contentResolver,
        Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES
    ) ?: return false
    
    val component = "${packageName}/.AppBlockerService"
    val componentFull = "${packageName}/${packageName}.AppBlockerService"
    
    return enabledServices.split(":").any { svc ->
        svc.equals(component, ignoreCase = true) ||
        svc.equals(componentFull, ignoreCase = true)
    }
}
```

**Why it works:**
- **Split by colon** → properly parse multiple services
- **Check both formats** → handle short AND full package path
- **Case-insensitive** → handle Android system case variations
- **Null-safe** → return false immediately if no services enabled
- **Exact match per service** → avoids false positives from substring overlap

### Debugging

Add logging to see raw Android system values:

```kotlin
val enabled = Settings.Secure.getString(
    contentResolver,
    Settings.Secure.ENABLED_ACCESSIBILITY_SERVICES
)
Log.d("PermissionDebug", "Raw enabled services: $enabled")
Log.d("PermissionDebug", "Detection result: ${isAccessibilityServiceEnabled()}")
Log.d("PermissionDebug", "Expected short: ${packageName}/.AppBlockerService")
Log.d("PermissionDebug", "Expected full: ${packageName}/${packageName}.AppBlockerService")
```

Expected log after user enables service:
```
Raw enabled services: com.sync.xxx/.AppBlockerService
Detection result: true
```

OR:
```
Raw enabled services: com.sync.xxx/com.sync.xxx.AppBlockerService
Detection result: true
```

If detection still returns false → logic error in split/comparison.

## Bug #2: Notification Listener Detection

**Same root cause** — simple `.contains()` fails on ComponentName format.

### Broken Pattern

```kotlin
private fun isNotificationListenerEnabled(): Boolean {
    val listeners = Settings.Secure.getString(
        contentResolver,
        "enabled_notification_listeners"
    )
    return listeners?.contains(packageName) == true
}
```

**Problem:** `packageName` might match SUBSTRING of other app's package. False positive risk.

### Working Pattern

```kotlin
private fun isNotificationListenerEnabled(): Boolean {
    val listeners = Settings.Secure.getString(
        contentResolver,
        "enabled_notification_listeners"

From harezadmm/omp-enhanced, MIT.

More from harezadmm/omp-enhanced