Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. Cordova Android security issue for Visual Studio projects

Cordova Android security issue for Visual Studio projects

Summary

Recently, Trend Micro announced the discovery of a security flaw in the Apache Cordova Android platform that affects all current versions of Cordova. The Cordova Community has released an update for Cordova to address this issue.

We recommend that all users of Microsoft Visual Studio 2013 CTPs or earlier versions of Microsoft Visual Studio 2015 CTPs upgrade to Microsoft Visual Studio 2015 RC or a later version. By using the latest Visual Studio release, you can take advantage of features that simplify the Cordova update process. We are also working with the Cordova community on a “tools release” for Cordova that will use the updated versions of the Cordova Android platform by default. We will also be updating the templates in Visual Studio to use this newer version of the platform.

In the meantime, you can immediately update your Microsoft Visual Studio projects to the updated version of the Cordova Android platform when you use Apache Cordova 4.3.0 or Apache Cordova 5.0.0 together with Tools for Apache Cordova 2015 RC. To do this, follow the steps in the "More Information" section.

↑ Back to the top

More Information

Updating your project

To update your Visual Studio project to use the updated version of the Cordova Android platform, you must add an XML element to Config.xml. To do this, follow these steps:

  1. In Visual Studio, right-click Config.xml, and then click View Code.
  2. Add the following entry under the root <widget> element, depending on your version of Cordova:

    For Cordova 4.3.0 (default version)

    <engine name="android" version="3.7.2" />
    For Cordova 5.0.0

    <engine name="android" spec="4.0.2" />

Additional step for existing Android builds

For projects for which you have already created a build for Android on your system, you must also remove the old version of the Cordova Android platform. To do this, follow these steps:
  1. Open a Command Prompt window, and then change to your Cordova project root folder (not the solution root).
  2. At the command prompt, type the following commands:

    npm install -g cordova 
    cordova platform remove android
The next time that you create a build, you will be using the updated version of the Cordova Android platform.

For an updated versions of the Visual Studio template Config.xml files and for a batch file that removes the old version of the Cordova Android platform when it is run from your project folder, go to the following GitHub website:

Cordova docs

↑ Back to the top

References

For the announcement about this issue that was issued by Trend Micro, go to the following Trend Micro website:

Trend Micro Discovers Apache Cordova Vulnerability that Allows One-Click Modification of Android Apps
For more information about the Apache Cordova update for this security issue, go to the following Apache Software Foundation website:

Apache Cordova Android 4.0.2 and 3.7.2 released
For more information about upcoming Cordova tools releases, see the "News" section of the Apache Cordova website.
Third-party information disclaimer
The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

↑ Back to the top

Keywords: kbtshoot, kbexpertiseadvanced, kbsurveynew, kb

↑ Back to the top

Article Info
Article ID : 3069704
Revision : 1
Created on : 1/7/2017
Published on : 6/1/2015
Exists online : False
Views : 88