fix(security): declare explicit network security config to forbid cleartext #20

wtclaude · 2026-07-21T04:40:30Z

wtclaude commented

2026-07-21 04:40:30 +00:00

What

Resolves the SonarQube S5332 hotspot: "usesCleartextTraffic is implicitly enabled for older Android versions" on app/src/main/AndroidManifest.xml.

The app is purely an HTTPS API client of a shard's website backend, so cleartext should be denied by default. The manifest previously left usesCleartextTraffic implicit. This adds an explicit network security config:

app/src/main/res/xml/network_security_config.xml (release/base posture): cleartextTrafficPermitted="false" — no cleartext at all.
app/src/debug/res/xml/network_security_config.xml (debug override): re-permits cleartext to loopback only (127.0.0.1 / localhost) for local dev against http://127.0.0.1:3000.
Wired via <application android:networkSecurityConfig="@xml/network_security_config">.

Why this shape

This mirrors, at the platform socket layer, the rule ServerUrl already enforces at the app layer (allowInsecureHttp = BuildConfig.DEBUG — HTTPS required in release, HTTP allowed only in debug for 127.0.0.1). Being explicit:

satisfies the scanner and prevents a merged library manifest from silently re-enabling cleartext, and
fixes a latent gap: at targetSdk 28+ the platform default already blocks cleartext, so the debug loopback path only actually works with the explicit domain-config added here.

Verification

:app:processDebugResources and :app:processReleaseResources — BUILD SUCCESSFUL.
Merged release manifest references @xml/network_security_config; release packaged config has 0 cleartextTrafficPermitted="true".
Merged debug manifest references the same; debug packaged config carries the loopback domain-config.

Docs

Matching doc update in RunicGateway/docs → android/PLAN.md (M1): branch fix/android-cleartext-doc.

AI-assisted: authored with Claude Code (Co-Authored-By: Claude).

🤖 Generated with Claude Code

## What Resolves the SonarQube **S5332** hotspot: *"usesCleartextTraffic is implicitly enabled for older Android versions"* on `app/src/main/AndroidManifest.xml`. The app is purely an HTTPS API client of a shard's website backend, so cleartext should be denied by default. The manifest previously left `usesCleartextTraffic` implicit. This adds an explicit **network security config**: - **`app/src/main/res/xml/network_security_config.xml`** (release/base posture): `cleartextTrafficPermitted="false"` — no cleartext at all. - **`app/src/debug/res/xml/network_security_config.xml`** (debug override): re-permits cleartext to **loopback only** (`127.0.0.1` / `localhost`) for local dev against `http://127.0.0.1:3000`. - Wired via `<application android:networkSecurityConfig="@xml/network_security_config">`. ## Why this shape This mirrors, at the platform socket layer, the rule `ServerUrl` already enforces at the app layer (`allowInsecureHttp = BuildConfig.DEBUG` — HTTPS required in release, HTTP allowed only in debug for `127.0.0.1`). Being explicit: - satisfies the scanner and prevents a merged library manifest from silently re-enabling cleartext, and - fixes a **latent gap**: at `targetSdk` 28+ the platform default already blocks cleartext, so the debug loopback path only *actually* works with the explicit `domain-config` added here. ## Verification - `:app:processDebugResources` and `:app:processReleaseResources` — **BUILD SUCCESSFUL**. - Merged **release** manifest references `@xml/network_security_config`; release packaged config has **0** `cleartextTrafficPermitted="true"`. - Merged **debug** manifest references the same; debug packaged config carries the loopback `domain-config`. ## Docs Matching doc update in `RunicGateway/docs` → `android/PLAN.md` (M1): branch `fix/android-cleartext-doc`. --- AI-assisted: authored with Claude Code (`Co-Authored-By: Claude`). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

wtclaude added 1 commit 2026-07-21 04:40:31 +00:00

fix(security): declare explicit network security config to forbid cleartext

PR Checks / android-build (pull_request) Successful in 10m30s

Details

26b8eecde6

The app is purely an HTTPS API client, but the manifest left
usesCleartextTraffic implicit, which SonarQube S5332 flags (cleartext is
implicitly permitted on older Android and a merged library manifest could
re-enable it). Add an explicit network security config:

- main/release: base-config cleartextTrafficPermitted="false" (no cleartext).
- debug override (app/src/debug/res/xml): re-permits cleartext to loopback
  (127.0.0.1/localhost) only, for local dev against http://127.0.0.1:3000.

This mirrors ServerUrl's rule (HTTPS required in release, HTTP allowed in
debug via allowInsecureHttp = BuildConfig.DEBUG) at the platform socket
layer. It also fixes a latent gap: at targetSdk 28+ the platform default
already blocks cleartext, so the debug loopback path only actually works
with the explicit domain-config now added.

Docs updated in RunicGateway/docs (android/PLAN.md M1).

Co-Authored-By: Claude <noreply@anthropic.com>

whitlocktech approved these changes 2026-07-21 04:41:42 +00:00

whitlocktech scheduled this pull request to auto merge when all checks succeed 2026-07-21 04:41:47 +00:00

whitlocktech merged commit c69d704881 into main

2026-07-21 05:25:39 +00:00

whitlocktech deleted branch fix/manifest-cleartext-traffic

2026-07-21 05:25:40 +00:00

whitlocktech referenced this issue from a commit

2026-07-21 05:25:40 +00:00

Merge pull request 'fix(security): declare explicit network security config to forbid cleartext' (#20) from fix/manifest-cleartext-traffic into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/Android-app#20