Search code examples
androidcordovaphonegap-buildcordova-3

Serious vulnerability in 3.5.0 on Android - cli issue when running build with cordova 3.6.3


Since there is a serious vulnerability in the cordova versions 3.5.0 and lower.

When I've updated cordova to 3.6.3

npm uninstall cordova -g
npm install cordova - g
cordova -v
3.6.3-0.2.13

I am also on phonegap version 3.5.0-0.21.18.

The build fails on cli saying that my Android SDK is missing a build.template for the platform tools. Here is what I have done done;

cordova platform rm android
cordova platform add android
phonegap build android

[phonegap] detecting Android SDK environment...
[phonegap] using the local environment
[phonegap] compiling Android...

C:\myapp\platforms\android\cordova\node_modules\q\q.js:126
throw e;
^
Error: ENOENT, no such file or directory 'C:\Android SDK\sdk\platform-tools\tools    \lib\build.template'

I have tired updating the SDK platform tools but this issue is still happening any ideas?


Solution

  • I think I've fixed this issue by doing the following;

    cordova platform rm android
    phonegap build android
    

    When I've removed the platform from my app and then tell phonegap to build it would seem that it downloads the latest cordova from the phonegap server rather than cordova's. It therefore installs cordova 3.5.1 rather than cordova 3.6.3 which by passes the vulnerabilty issue and resolves phonegap command line from not building.

    I hope that helps anyone else who may have encountered this problem, seems odd that there is no information on phonegap's website about this.