5.15.0 Release adds unwanted permissions

[toxikman]

Because the Facebook core library now includes a dependency on com.android.installreferrer:1.1, which (perhaps because of a bug) fails to include a targetSdkVersion in the library manifest. Therefore, gradle will assume the installreferrer library targets Android API < 4, in which case, the build tools will implicitly add these permissions to the AndroidManifest.xml:

<uses-permission android:name="android.permission.READ_PHONE_STATE" />
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />

Expected Results:
Having a dependencies on the Facebook Sdk should not add unwanted Android permissions.

Build Tools Configuration
Using gradle 4.6 and gradle library 3.2.1 (required by Unity 2017.4.x)
Android Build Tools 29.0.2
Android SDK Platform 29

[carlos-mg89]

I realized about this as well.

Although not ideal, the temporary way to prevent these permissions from being requested is to add in the AndroidManifest.xml the following line:

<uses-permission android:name="android.permission.READ_PHONE_STATE" tools:node="remove" />

This is kind of a regression, since it happened on previous versions of this library, as I saw while looking for issues. Probably because of a different matter though.

[Feenposhleen]

This issue is really annoying for us Flutter (and maybe other cross-platform) users, since FB plugins mostly uses major-only dependency versions[0] for the FB core sdk. Manually mending manifests (in our case, generated) as suggested may not be possible for us.

installreferrer:1.1 should probably be considered broken, and downgraded until fix is published. Read/write external storage are no-joke permissions that end users should be/are wary of.

[0] https://github.com/rafalbednarczuk/facebook_analytics/blob/3ce264e030c5014007074a40261ee7d00e2d99b5/android/build.gradle#L42
https://github.com/oddbit/flutter_facebook_app_events/blob/5416cfa185028d41e6beacdbcc9485a1ab939196/android/build.gradle#L44

[Mxiim]

Hi,
I agree that this is a big issue. I will take a look at it today.

[stale]

Hey there, it looks like there has been no activity on this issue recently. Has the issue been fixed, or does it still require the community's attention? This issue may be closed if no further activity occurs. Thank you for your contributions.

[stale]

Closing this issue after a prolonged period of inactivity. If this issue is still present in the latest release, please feel free to create a new issue with up-to-date information.

[toxikman]

It looks like Google has fixed this manifest problem in install-referrer version 2.0. Perhaps the Facebook team should consider updating to this if the latest version is important to have.

[sistr22]

I have to say it's a big issue for us too. We currently are manually removing the permission but it's far from ideal.