How to use proguard in cordova android App

Question

I have a finished cordova project and i want to use proguard inorder to prevent others from reverse engineering the APK.But i have trouble doing this.

In http://developer.android.com/tools/help/proguard.html

It says that "When you create an Android project, a proguard.cfg file is automatically generated in the root directory of the project. " But i cannot find a such file. So how do i apply proguard to my app?

Thank you

Answer 1

You need to uncomment below lines from your project.properties file

To enable ProGuard to shrink and obfuscate your code, uncomment this (available properties: sdk.dir, user.home):

proguard.config=${sdk.dir}/tools/proguard/proguard-android.txt:proguard-project.txt

Also, if you are using Webview with JS, uncomment following lines in proguard-project.txt and specify the fully qualified class name to the JavaScript interface class:

-keepclassmembers class com.your.package.YourJSInterfaceClass {
   public *;
}

Answer 2

I share with you my proguard for cordova. This is for a hello world app:

# For more details, see
#   http://developer.android.com/guide/developing/tools/proguard.html

# Add any project specific keep options here:
#-dontshrink
#-dontoptimize
#-dontobfuscate

# If your project uses WebView with JS, uncomment the following
# and specify the fully qualified class name to the JavaScript interface
# class:
#-keepclassmembers class android.webkit.WebView {
#   public *;
#}

#-injars      bin/classes
#-injars      libs
#-outjars     bin/classes-processed.jar

# Specifies to write out some more information during processing.
# If the program terminates with an exception, this option will print out the entire stack trace, instead of just the exception message.
-verbose

# Annotations are represented by attributes that have no direct effect on the execution of the code.
-keepattributes *Annotation*

-keepclassmembers enum * {
    public static **[] values();
    public static ** valueOf(java.lang.String);
}

-keepattributes InnerClasses
-keep class **.R
-keep class **.R$* {
    <fields>;
}

# These options let obfuscated applications or libraries produce stack traces that can still be deciphered later on
-renamesourcefileattribute SourceFile
-keepattributes SourceFile,LineNumberTable

# Enable proguard with Cordova
-keep class org.apache.cordova.** { *; }
-keep public class * extends org.apache.cordova.CordovaPlugin

-keep class org.apache.cordova.CordovaBridge { org.apache.cordova.PluginManager pluginManager; }
-keep class org.apache.cordova.CordovaInterfaceImpl { org.apache.cordova.PluginManager pluginManager; }
-keep class org.apache.cordova.CordovaResourceApi { org.apache.cordova.PluginManager pluginManager; }
-keep class org.apache.cordova.CordovaWebViewImpl { org.apache.cordova.PluginManager pluginManager; }
-keep class org.apache.cordova.ResumeCallback { org.apache.cordova.PluginManager pluginManager; }
-keep class org.apache.cordova.engine.SystemWebViewEngine { org.apache.cordova.PluginManager pluginManager; }

-keep class com.worklight.androidgap.push.** { *; }
-keep class com.worklight.wlclient.push.** { *; }

# Enable proguard with Google libs
-keep class com.google.** { *; }
-dontwarn com.google.common.**
-dontwarn com.google.ads.**
-dontwarn com.google.android.gms.**

# apache.http
-optimizations !class/merging/vertical*,!class/merging/horizontal*,!code/simplification/arithmetic,!field/*,!code/allocation/variable

-keep class net.sqlcipher.** { *; }
-dontwarn net.sqlcipher.**

-keep class org.codehaus.** { *; }
-keepattributes *Annotation*,EnclosingMethod

-keepclassmembers enum * {
    public static **[] values();
    public static ** valueOf(java.lang.String);
}

# Remove debug logs in release build
-assumenosideeffects class android.util.Log {
    public static *** d(...);
}

# These classes contain references to external jars which are not included in the default MobileFirst project.
-dontwarn com.worklight.common.internal.WLTrusteerInternal*
-dontwarn com.worklight.jsonstore.**
-dontwarn org.codehaus.jackson.map.ext.*

-dontwarn android.support.v4.**
-dontwarn android.net.SSLCertificateSocketFactory
-dontwarn android.net.http.*

# These clases contain references to cordova webView
-keep class com.ionicframework.cordova.webview.** {*; }
-keep class com.ionicframework.cordova.webview.*

Answer 3

For some reason, in React Native app I could see it being created automatically, but in Cordova app not. By following that I was able to figure out what has to be done to add it:

1. Create file MY_PROJECT/platforms/android/app/proguard-rules.pro
2. Add whatever code you have regarding ProGuard to the file MY_PROJECT/platforms/android/app/proguard-rules.pro
3. In MY_PROJECT/platforms/android/app/build.gradle (watch out: there's another build.gradle inside MY_PROJECT/platforms/build.gradle - do not confuse), it should be in the same folder where you've created the MY_PROJECT/platforms/android/app/proguard-rules.pro add proguardFiles getDefaultProguardFile("proguard-android.txt"), "proguard-rules.pro" in the buildTypes -> release.