Google Play Warning Incorrect Implementation of Go

Question

I just received the following email from Google Play

'Hello Google Play Developer,

We detected that your app(s) listed at the end of this email are invoking the in-app billing service without setting a target package for the intent. This can enable a malicious package to bypass the Play store billing system and access items that have not been purchased.

Next Steps

If you are using IabHelper, please start using the latest SDK. If you are manually invoking the in-app billing service, make sure you are calling Intent.setPackage(“com.android.vending”) on any intents to "com.android.vending.billing.InAppBillingService.BIND". Sign in to your Developer Console and submit the updated version of your app. Check back after five hours - we’ll show a warning message if the app hasn’t been updated correctly.'

I am not sure what is the fix for this problem. Can anyone tell where to specify the code? Is it somewhere in Java Class or the Manifest?

Answer 1

The fix will be in your Java. Search your codebase for an Intent with the action "com.android.vending.billing.InAppBillingService.BIND", either passed into the constructor or set via Intent.setAction(). Before calling bindService() with that intent, you must explicitly set the package via Intent.setPackage().

Here is Google's sample code as reference: https://github.com/googlesamples/android-play-billing/blob/master/TrivialDrive/app/src/main/java/com/example/android/trivialdrivesample/util/IabHelper.java#L296

Answer 2

You must update your IabHelper files with last SDK from:

https://github.com/googlesamples/android-play-billing/tree/master/TrivialDrive/app/src/main/java/com/example/android/trivialdrivesample/util

When you overwrite old files, Eclipse or Android Studio will display errors and you have to fix them, for example add try catch, or add one parameter to queryInventory function.

Remember update package name in new files if you changed it.

EDIT: Also finally I need update google_play_services.jar lib included in my project. After update this notification alert has hidden. I was using an older google play service lib. Now I am using rev 28 version.

Answer 3

Did not test this solution but you might still try it: replace serviceIntent.setPackage("com.android.vending"); with serviceIntent.setPackage("com.android.vending.billing.InAppBillingService.BIND"); in https://github.com/googlesamples/android-play-billing/blob/master/TrivialDrive/app/src/main/java/com/example/android/trivialdrivesample/util/IabHelper.java#L297 or anywhere you have setPackage thing. Cheers.

UPDATE: Just update Google Play Services lib, worked for me. Cheers.

Answer 4

There are three points to solve this problem.

1. Find com.android.vending.billing.InAppBillingService.BIND in your codes. Let every Intent to this call the method Intent.setPackage(“com.android.vending”).
2. Update SDK of IabHelper.
3. Update the Google Play Service library project. Make sure that these things are done correctly. Every point undone leads to this problem. If the problem still exists, maybe there is something wrong with other jars in your project.

Answer 5

I had this issue and couldn't afford updating our old pipeline based in eclipse. So I basically decompiled google play service's library, patched the vulnerabilities in eb.java and dx.java, recompiled those two files and put them into the original JAR file. This is explained in my blog.

Answer 6

I received the same warning. I was already setting the package when binding the InAppBillingService but I found that I was checking if the InAppBillingService exists like this:

boolean inAppBillingAvailable = !getPackageManager().queryIntentServices(new Intent("com.android.vending.billing.InAppBillingService.BIND"), 0).isEmpty();

Make sure you are also setting the package here:

boolean inAppBillingAvailable = !getPackageManager().queryIntentServices(new Intent("com.android.vending.billing.InAppBillingService.BIND").setPackage("com.android.vending"), 0).isEmpty();