Following the Google developer instructions on implementing Firebase in my app, I notice that android lint complains.
The idea is that we have to implement two services which inherit from Firebase services:
public class MyFirebaseInstanceIDService extends FirebaseInstanceIdService { ... }
public class MyFirebaseMessagingService extends FirebaseMessagingService { ... }
and then register those services in the manifest. But, it's not quite perfect. In particular, these two recommended AndroidManifest.xml service entries do not contain any special permissions:
<service android:name=".MyFirebaseMessagingService">
<intent-filter>
<action android:name="com.google.firebase.MESSAGING_EVENT"/>
</intent-filter>
</service>
<service android:name=".MyFirebaseInstanceIDService">
<intent-filter>
<action android:name="com.google.firebase.INSTANCE_ID_EVENT"/>
</intent-filter>
</service>
and so the linter says:
Exported services (services which either set exported=true or contain an intent-filter and do not specify exported=false) should define a permission that an entity must have in order to launch the service or bind to it. Without this, any application can use this service.
Should I just add this attribute to each service tag and be done with it
tools:ignore="ExportedService"
or is there a better approach in this situation? I mean, is it safe to expose these particular Firebase derived services like this?