Israel's Ministry of Health's COVID-19 Exposure Prevention App
Home Page: https://health.gov.il/
License: MIT License
Israel's Ministry of Health's COVID-19 exposure prevention app.
You're awesome. See CONTRIBUTING.md.
HaMagen is based on react-native, react-native-background-geolocation & rn-contact-tracing.
Please review at: https://medium.com/proferosec-osm/hamagen-application-fighiting-the-corona-virus-4ecf55eb4f7c
Copyright (c) 2020 Israel's Minsitry of Health
This project is licensed under the terms of the MIT license. See the LICENSE file.
Can add option to share the app from inside app...
https://reactnative.dev/docs/share
for example in this message about corona in rishon lezion you can see
"14.3: בשעות 19:30-19:45 חנות דקתלון רחוב הלחי 4, בראשון לציון"
which is no where to be found in the points.json file
Just to be on the safer side of things.
Isn't 500 meters for 1 millisecond a bit strict?
meterRadius: 500,
intersectMilliseconds: 1, // 1 milliThe official guidelines are 2 meters for 15 minutes.
Have you considered using Google Analytics?
Can help improve the performance and relevance, also really easy to use.
In some of the queries that are executed in Database.js, you used string formatting instead of prepared statements.
I don't see how it leads to an actual security vulnerability - the only scenario I can imagine is that attacker with access to your server will be able to modify the saved user locations in the database (via malicious OBJECTID, for instance. see containsObjectID()) , but it's really impractical.
Although it's far from critical, it is a bad practice, and you should use prepared statements instead.
What distance is measured between people?
Was exposure time taken into account?
Were inacurecies (of the cellular network, wifi structure) taken into account?
what about scenarios like - were they taken into account:
two people on both side of a wall (two apartments for example - horizontal / vertical)
two people in two cars one near another
single none segregated wifi in a building can show that the whole building is exposed
Does the government understand this is indicative? and there are many cases that will require further investigation?
The info text about being exposed is overlapping and is hard to read. This problem is present only in Hebrew and English, Russian and Arabic seems to be fine.
(Also, the fifth language seems to be missing encoding and therefore shows question marks)
iPhone 6, iOS 10.3.3, app ver. 1.0.20 (updated on 23/3/2020)
Hi @MohGovIL! Welcome to GitHub ;)
I was wondering if there is a plan to add a CI pipeline? it's useful and important especially because you are using TypeScript in this project - some issues could be detected easily in build time.
GitHub Actions supports React Native builds for iOS and Android (see https://blog.usejournal.com/automate-react-native-builds-with-github-actions-af54212d26dc )
Also, it could be done with Microsoft AppCenter (https://appcenter.ms/) - it can also automate the complete CD pipeline, and publish artifact to the App Stores automatically :)
I would like to add spanish support.
On bus rides with multiple stops, having only one point causes partial route overlaps to be missed.
Suggested fix: include an additional point, 20 meters before and after each bus stop along the route, to detect partial overlaps. 20 meters away from the stop, not at the stop itself, to avoid false positives when a sick person is on a bus, and the user is standing in the bus stop waiting for another bus. Alert only if both points between two stops are positive, which indicates that both passengers were indeed on the same bus.
I'll be happy to fix it and contribute
Launch screen gets over scaled:
The iPhone SE is equipped with a 4‑inch (diagonal) LED‑backlit widescreen Multi‑Touch Retina display with 1136‑by‑640‑pixel resolution at 326 ppi.
After which user is stuck in the following screen, where the checkbox can be marked but no location privacy prompt is popping. Off screen button which needs to be tapped?
Storing all firebase, and other credentials in the code is a possible hazard. Please create new Auth clients, move their credentials to a .env, git ignore it first of course, and use Process.ENV to fill credentials on build.
Example file:
https://github.com/MohGovIL/hamagen-react-native/blob/master/android/app/src/release/google-services.json
I think it's better to have commit conversions since it's an open-source project it might be easier for new developers to see common commit conversions for example:
feat, chore, update, add, etc.
Also, separate your commits to subjects, and don't commit all your changes in one commit.
If have Hebrew or any other language need to translate it too.
For people that don't know Hebrew...
And this government app and in israel Hebrew is the main language :)
OS: iOS
Device: iPhone X
Upon clicking on privacy policy (both on initial setup and in the app). I am getting the following screen:
How can one download the data of previous cases, to compare with it? I can export my location history to JSON, and I plan to write a program to locally compare it to your database. Is it possible to get the sick cases locations raw data?
Currently, checkSickPeople is doing a fetch to the base URL (locations DB) and gets it in its entirety.
Second, it iterates over the sick people locations DB, end for each document it iterates over the local DB which is O(m*n) (where m and n are the remote and local DB sizes).
As infections will become large (hopefully it wouldn't) this may be a bottleneck for the application, causing memory and performance issues.
While it is mostly a server-side work for enabling a more flexible API, I can try to make some suggestions.
Personal location history can be downloaded from here
hamagen-react-native/ios/codeAgainstCorona/Info.plist
Lines 31 to 43 in 0563506
This basically says, lets disable ATS for everything except localhost 🤔
Unfortunately, the release keystore passwords were revealed in the code. in android/app/build.gradle. That being said, the releaseKeystore WAS NOT exposed. So we're safe. Nevertheless, we'll generate a new release keystore with a safe password.
The app can't get android.permission.GET_TASKS data unless running as system anyway, since Lollipop. It also don't really need that data, so it's safe to remove.
As a security person, I would want to avoid from hard coded keys.
If I got it right, the debug mode will allow an attacker to use this to impersonate the application as legitimate request and contaminate the db.
Let me know what you think and if this could be change, thanks.
At least on the Play store, I'm not able to install the app because my account is linked to the US store.
I suspect this is the cause of most problems at #26 - the store message make it seem like a device issue, but I'm on a clean Android on Pixel 3a so I doubt that's the cause.
by looking in this func, i can see that POINT_X and Y is taken from the sick record,
but observing the db : https://gisweb.azureedge.net/Points.json
i notice that most of these points are either null or 0, the actual thing to compare probably is
sickRecord.geometry.sickRecord[0] and [1]
Will you publish compiled APK for non-Google Play phones?
(e.g https://grapheneos.org/)
Getting stuck on the following screen (see below) - not asking for location permissions, or allowing to move forward. Uninstall and install again does not change the situation:
Notice how in the setting screen, we can't even enable location permissions:
OS details:
iPhone 7
OS Version: 13.3.1
The application collects the user WiFi information to the database but doesn't make any use of it.
In the Points.json file, each exposure object should contain the sick case number in the Name property, under the properties, as you use it here.
{
"type": "Feature",
"id": 7031,
"geometry": {
"type": "Point",
"coordinates": [
34.9617953000001,
32.3125987
]
},
"properties": {
"OBJECTID": 7031,
"Name": MISSING,
"Place": "סופרמרקט חינם פלוס צומת תנובות ",
"Comments": "",
"POINT_X": 34.9617953,
"POINT_Y": 32.3125987,
"fromTime": 1583677800000,
"toTime": 1583681400000,
"sourceOID": 1,
"stayTimes": "14:30-15:30"
}
}Why not open to all countries?
Some of us are using Non Israeli google accounts in the phone due to needing american apps.
Also, there might be foreign people in Israel with foreign accounts as well, who currently live here, and should use the app as well.
Enlarge the text on the app, there is a lot of unused space, so the text can be displayed with larger fonts that can be more readable
When opening in Google play store, because my current payment address is in the US. I don't think there should be a restriction as I am currently in Israel
The 'APPROVE' button is missing during {Eng / Rus} installation on Xiaomi Mi A2. with large font OS settting on. The issue probably occurs due to disabled scrolling in installation phase.
Impact: the issue prevents, for example, {Eng / Rus} speakers with large font setting on, from installing the app, if they don't switch to Hebrew.
If enabling scrolling on this specific dialog isn't an option (as suggested by @YOEL311 – "you can't do ScrollView in a Model") a possible solution might be to override the OS font size settings and to pick the size depending on the actual screen size -- so that the entire dialogue, including the 'APPROVE' button will fit 100% of the times, independent of OS / font settings / device.
src\config\config.ts
old:
title: 'Возможно, обнаружено одно или несколько совпадений',
body: 'Нажмите здесь, чтобы узнать, если вы были выставлены'
suggested:
title: 'Найдено возможное нахождение вблизи зараженного',
body: 'Нажмите чтоб проверить если вы были вблизи зараженного'
suggest some fixes here:
https://matrixdemos.blob.core.windows.net/mabar/texts.json
"ru": {
"general": {
"start": "Начать",
"additionalInfo": "политика конфиденциальности"
},
"languages": {
"title": "Выберите язык",
"short": {
"he": "עב",
"en": "En",
"ru": "Ru",
"ar": "عر",
"am": "አማ"
},
"long": {
"he": "עברית",
"en": "English",
"ru": "Русский",
"ar": "عربيه",
"am": "አማርኛ"
}
},
"forceUpdate": {
"title": "Обновить версию",
"desc": "Появилась новая версия приложения. Чтобы продолжать поддерживать здоровье всех нас, мы рекомендуем обновить версию"
},
"forceTerms": {
"title": "Условия использования обновлены",
"desc": "Обновлены Условия использования приложения, чтобы мы могли продолжать поддерживать ваше здоровье. Примите новые Условия использования.",
"approve": "Подтвердить"
},
"welcome": {
"title": "Мы рады что вы присоединились к нашим усилиям!",
"subTitle1": "Тысячи израильтян могут пострадать от коронавируса.",
"subTitle2": "Диагностирование и карантин могут спасти их жизнь. Спасибо что помогаете нам!"
},
"location": {
"title": "Местонахождение критично",
"subTitle1": "Приложение будет собирать данные о вашем местонахождении, и сообщит вам если будет совпадение с данными местонахождения больных.",
"subTitle2IOS": "Ради этого вы должны включить услуги местонахождения на постоянной основе",
"subTitle2Android": "Ради этого вы должны включить услуги местонахождения на постоянной основе",
"dataAnonymous": "Данные будут сохранены анонимно",
"consent1": "Я прочитал и согласен с условиями ",
"consent2": "пользования",
"approveLocation": "Подтвердить"
},
"locationIOS": {
"title": "Включение услуг местонахождения\nна постоянной основе",
"subTitle1": "Чтобы регулярно получать точную информацию о вашим местонахождении, включите услуги местонахождения на постоянной основе.",
"subTitle2": "Измените настройки как указано в фотографиях",
"goToSettings": "Настройки",
"set": "Продолжить"
},
"notifications": {
"title": "Важно вас проинформировать",
"subTitle1": "Чтобы информировать вас об релевантных для вас событиях связанных с коронавирусом, подтвердите пожалуйста получение нотификаций от нас.",
"subTitle2": "Получение нотификаций от нас необходимо для вас и ваших близких.",
"approveNotifications": "Подтвердить получение нотификаций"
},
"allSet": {
"allGood": "Отлично!\nСейчас начнём"
},
"scanHome": {
"hasData": "успешная передача данных",
"noData": "Нет передачи данных",
"exposureHistory": "История контактов",
"noDataDesc": "Проверьте связь к интернету и услуги местонахождения",
"noExposure": "По имеющимся данным, вы не контактировали с больным.",
"noExposure1": "По данным собранным до сих пор,",
"noExposure2": "с:",
"noExposure3": "в:",
"noExposure4": ",мы не обнаружили контакта с больным",
"recommendation": "Вы можете закрыть приложение.Вся необходимая информация поступит к вам отдельным сообщением.",
"found": "Обнаружены",
"exposureEvents": "Потенциальное соприкосновение",
"reportedAt": "Документально записан",
"inDate": "Число",
"fromHour": "С часов,:",
"toHour": "до часов:",
"whereYouThere": "Были ли вы в этом месте в то же время?",
"no": "Нет",
"canContinue": "Можно продолжить",
"yes": "Да",
"needDirections": "Инструкции"
},
"exposuresHistory": {
"title": "История контактов",
"noExposures": "Нет точек соприкосновения"
},
"exposureInstructions": {
"title": "Рекомендации после выявления контакта",
"weUnderstand": "Вы оказались в точке соприкосновения",
"wrong": "Ошибка, я там не был.",
"keepSafe": "В целях поддержания вашего здоровья, здоровья вашей семьи и окружающих вас людей руководствуйтесь рекомендациями Министерства Здравоохранения и пожалуйста, примите следующие меры",
"goIntoIsolation": "исключите полностью контакты с другими людьми на протяжении 14 дней, не выходя из дома",
"reportIsolation": "оставьте сообщение на сайте Министерства Здравоохранения о вашем карантине",
"allInstructions": "Инструкции",
"reportSite": "Поставить в известность"
}
},
At the current release, the criterion for finding an intersection between a corona carrier to a given user on the production environment is "500 meter for 1 millisecond", which obviously does not make any sense.
./config/config.ts
Is:
{
..
meterRadius: 500,
intersectMilliseconds: 1, // 1 milli
}Should:
{
..
meterRadius: 10,
intersectMilliseconds: 1000 * 60 * 15, // e.g. 15 minutes
}Using a Meizu 15 Lite, Android 7.1.2, but can't install for some reason.
i get device not supported for xiaomi redmi note 5 with latest os updates
Hi,
I'm not sure you save the time that the user stay in each location. It's very important to take it into account because there could be a scenario that user has been within the same location but for few seconds.
It there a reason to use Redux? It seems like there is a mixup of Redux state, hooks and props passing across this repo. It could be simplified by using hooks for most cases, and use React context to manage state and share it across components.
I know hooks doesn't completely replace Redux and state, but in this case, and in small apps, it could simplify things.
I can help with improving it if the maintainers are ok with it :)
When I report a bug, I need to tell you on what version/release it happens.
I didn't see any "version info" screen.
If I installed the APP and went into the house of a person that is in quarantine and than back to my home, will I get notified about that?
You can use free tools to make sure you are always using the latest dependencies. From what I can see now, some are already outdated.
With a simple CI pipeline (#34) you can easily detect issues with updated dependencies before merging to master.
I can recommend on Renovate (https://github.com/renovatebot/renovate) , it's simple and nice (and it works for NodeJS dependencies and also for Pods)
It seems like there is an issue while trying to run the app on for iOS (using yarn ios). I'm using the latest commit from master.
I created a PR here that fixes those issues: #38
react-native unlink react-native-background-geolocation to fix linking issuescd ios && pod install)ios script to run: react-native run-ios --scheme hamagenThe first issue is that react-native-background-geolocation is linked manually, which is no longer needed in RN 0.60.
The log output is:
➜ hamagen-react-native git:(fix-deps) yarn ios
yarn run v1.22.4
$ react-native run-ios
error React Native CLI uses autolinking for native dependencies, but the following modules are linked manually:
- react-native-background-geolocation (to unlink run: "react-native unlink react-native-background-geolocation")
This is likely happening when upgrading React Native from below 0.60 to 0.60 or above. Going forward, you can unlink this dependency via "react-native unlink <dependency>" and it will be included in your app automatically. If a library isn't compatible with autolinking, disregard this message and notify the library maintainers.
Read more about autolinking: https://github.com/react-native-community/cli/blob/master/docs/autolinking.md
Running react-native unlink react-native-background-geolocation does fix the issue.
Also, documentation doesn't refer to the actual setup flow required to make iOS app work.
For iOS, pods should be installed prior to starting rn. To fix that, it requires to do: cd ios && pod install
Then, there are issues with the XCode scheme - it has the incorrect name configured, and the existing schemes doesn't seems to be shared correctly, or pointing to an incorrect scheme.
The error is:
xcodebuild: error: The workspace named "codeAgainstCorona" does not contain a scheme named "codeAgainstCorona". The "-list" option can be used to find the names of the schemes in the workspace.
RN looks for codeAgainstCorona because of mismatch in the configuration. The actual name of the scheme is hamagen (could be listed using xcodebuild -workspace codeAgainstCorona.xcworkspace -list).
To fix that, we need to point to the correct scheme (which is missing in the repo from the first place, because it's was not shared correctly) in ios script in package.json:
react-native run-ios --scheme hamagen
Android 6.0.
LG K10.
Icon on notification bar is an empty white rectangle.
Expected: app logo.
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.