Summary | Résumé

This may or not be an issue, depending on if my understand is correct or not. In DebugMetricsHelper.kt we have getLifecycleDailyCount. The DebugMetricsHelper has a cache for cachedLifecycleDailyCount which is initially null. What is the lifetime of this class? Does it get re-created every time we wakeup in the background? Every time the app is opened? When does that cache value get reset, essentially.

If the cache is reset each background invocation then when we get into getLifecycleDailyCount we'll see the cache is null we then check the last cache time, and if it was today, we return 0, this will then set the cache to 1. If it wasn't today, we read the cache value. It seems like this would, potentially, reset the LifecycleDailyCount to 1 a lot more then we expect?

Could we remove the cache from this code to simplify things? (Are we caching because the retrieval from sharedPreferences is slow?)

Would something like the following work?

fun getLifecycleDailyCount(context: Context): Number {
  val sharedPreferences = context.getSharedPreferences(SharedPreferencesFileKey, Context.MODE_PRIVATE)
  val cachedCount = sharedPreferences.getInt(LifecycleDailyCountKey, 0)
 
  if (didDayChange(LifecycleDailyCountResetTimestampKey, context)) {
    cachedCount = cachedCount + 1
    with (sharedPreferences.edit()) {
      putInt(LifecycleDailyCountKey, cachedCount)
      apply()
    }
  }
  return cachedCount
}

(If the above works a similar change could also be applied to getSuccessfulDailyBackgroundChecks and possibly other methods which cache values.

Environment : Pixel 3XL - Android v9 (BrowserStack), version v14

Scenario :

• Make sure your phone has push notifications turned off for the app
• Open the app
• Open the menu

Issue : There is a tile "Push notifications are off" with an arrow on it indicating that clicking on this tile would redirect users somewhere but I cannot click on it (nothing happens on click). Not sure if this tile was supposed to redirect somewhere or not...

Summary | Résumé

App did not check for exposures for a whole week on two separate occasions between Dec 11-18 and Dec 2-9. My phone is on 99.9% of the time, with internet access and Bluetooth has consistently been on. Exposure logs attached. all-exposure-checks.json.txt

Steps to reproduce | Étapes à reproduire

I did not open the app on a regular basis because I did not expect to be required to do so - as the documentation assured that it would not be necessary.

Environment | Environnement logiciel

Google Pixel 3a, COVID Alert 1.1.3, Android 11.

Unresolved questions / Out of scope | Questions non résolues ou hors sujet

Are there any related issues you consider out of scope for this issue that could be addressed in the future?

It would be useful to know if your device has recorded any keys.... how am I to know that my device was recording anything during those time gaps.

Environment: Nexus 6, Android 6 (Browserstack)

To reproduce:

• Before installing the app, disable Bluetooth
• Install

User gets message that the phone is running Bluetooth

Summary | Résumé

I am running IOS 14.2 beta 2 on iPhone X. After a phone restart, the next time the Covid App was opened, it claimed the collection was off.

and the iPhone screen shows:

The App does not seem to re-synchronize to the ON state and the iPhone screen promises to delete all my exposure data if I try the turn off and on fix. So I assume the onus falls to the Covid App to get itself On again somehow.

Steps to reproduce | Étapes à reproduire

Sequence from memory of how I got out of sync; cannot repeat as my phone is in an out-of-sync state now.

1. Covid app was working on IOS14.2

2. Upgraded to IOS 14.2 beta 2 developer beta

3. Covid App worked (I'm pretty sure but not 100% on this)

4. iPhone restarted.

5. Covid App opened now in off state.

Environment | Environnement logiciel

iPhone X IOS14.2 beta 2 (developer beta)

Unresolved questions / Out of scope | Questions non résolues ou hors sujet

This out of sync is not a desired state. If it remains possible the a help procedure to correctly recover sync without losing the last 14 days of exposure data would be desirable

Resolves https://github.com/cds-snc/covid-alert-app/issues/891

How to test

• Run

rm -rf node_modules/react-native-system-setting
yarn add [email protected]
yarn

• Open the app, pass onboarding flow and enable EN.
• Verify CovidAlert is active.
• Go to device settings, disable location.
• Back to the app, verify CovidAlert is inactive.
• Turn on EN in the app, verify that location is enabled.
• Turn off bluetooth.
• Back to the app, verify CovidAlert is inactive.
• Turn on EN in the app, verify that bluetooth is enabled.
• Keep the app in foreground, toggle Location off in notification bar (not system settings), verify that the app change status properly.

COVID Alert crashed while in the background while another app was being used. My partner is blushing about her choice of game, but here's a screen shot 😸 :

This happened somewhere around 20:00 ET on July 2, 2020 and she tapped Share, so there should be a dump of the issue in the Apple App Store Connect account. Since it crashed in the background, it may or may not be relevant that she has the iOS Setting Background App Refresh set to Off.

Some extra details:

• Device: iPhone 7
• OS: iOS 13.5.1
• App Version: 1.0 (13)

Environment : Pixel 3XL, Android v9 (BrowserStack), version v14

Scenario :

• Go to Enter you code screen from the menu
• Enter a 8-digit code and submit
• Click on "Agree" on the upload code screen

Expected : A notification about "share you random codes" is displayed on top of the upload code screen

Issue : The screen in the background of the notification is on an infinite load state

Summary

This PR removes usage of react-native-safe-area-context as it causes crashes on Android on prod. New SafeAreaView component should be used as a replacement for handling notches on both Android and iOS.

Test instructions

Go through onboarding and all screens in the app on both Android / iOS with and without notches.

Help requested

Things that you (the submitter) want reviewers to pay very close attention to when they review this.

Unresolved questions / Out of scope

Are there any related issues or tangent features you consider out of scope for this issue that could be addressed in the future?

Reviewer checklist

This is a suggested checklist of questions reviewers might ask during their review:

• [x] Does this meet a user need?
• [x] Is it accessible?
• [x] Is it translated between both offical languages?
• [x] Is the code maintainable?
• [x] Have you tested it?
• [ ] Are there automated tests?
• [ ] Does this cause automated test coverage to drop?
• [ ] Does this break existing functionality?
• [ ] Should this be split into smaller PRs to decrease change risk?
• [ ] Does this change the privacy policy?
• [ ] Does this introduce any security concerns?
• [ ] Does this significantly alter performance?
• [ ] What is the risk level of using added dependencies?
• [ ] Should any documentation be updated as a result of this? (i.e. README setup, etc.)

One Plus 3 Android 8 App version 33 is installed COVID 19 Exposure notifications are ON, Notifications = On Bluetooth = On Entered a valid diagnosis code earlier this morning.

Left the app running in the background and left phone. 1hr or so later, returned to phone and had a message: COVID Alert has stopped. see image. Was able to reproduce it 3x

VoiceOver doesn't announce that this is a list (highlighted in screenshot). It should say "list start" and "list end". VoiceOver should also say "bullet" for each list item but instead it says "unpronounceable, black circle" for each bullet.

iOS 13.5.1 on iPhone 7

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `yarn` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- | 619/1000
Why? Has a fix available, CVSS 8.1 | Remote Code Execution (RCE)
SNYK-JS-SHELLQUOTE-1766506 | No | No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Remote Code Execution (RCE)

Snyk has created this PR to fix one or more vulnerable packages in the `rubygems` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • Gemfile.lock

Vulnerabilities that will be fixed

With an upgrade:

Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- | 691/1000
Why? Recently disclosed, Has a fix available, CVSS 8.1 | Deserialization of Untrusted Data
SNYK-RUBY-JMESPATH-2859799 | No | No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Deserialization of Untrusted Data

Snyk has created this PR to fix one or more vulnerable packages in the `yarn` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- | 768/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5 | Prototype Pollution
SNYK-JS-ASYNC-2441827 | No | Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

Snyk has created this PR to fix one or more vulnerable packages in the `yarn` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- | 519/1000
Why? Has a fix available, CVSS 6.1 | Denial of Service (DoS)
SNYK-JS-HERMESENGINE-2342071 | No | No Known Exploit | 619/1000
Why? Has a fix available, CVSS 8.1 | Remote Code Execution (RCE)
SNYK-JS-SHELLQUOTE-1766506 | No | No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Remote Code Execution (RCE)

Snyk has created this PR to fix one or more vulnerable packages in the `yarn` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

  • package.json
  • yarn.lock

• Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches. Find out more.

Vulnerabilities that will be fixed

With a Snyk patch:

Severity | Priority Score (*) | Issue | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:------------------------- | 731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2 | Prototype Pollution
SNYK-JS-LODASH-567746 | Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

Snyk has created this PR to fix one or more vulnerable packages in the `yarn` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • yarn.lock

Vulnerabilities that will be fixed

With an upgrade:

Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- | 479/1000
Why? Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
SNYK-JS-CSSWHAT-1298035 | No | No Known Exploit | 589/1000
Why? Has a fix available, CVSS 7.5 | Regular Expression Denial of Service (ReDoS)
SNYK-JS-NTHCHECK-1586032 | No | No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.