From 26b8eecde69866943901c64fb6ae63c778b562c0 Mon Sep 17 00:00:00 2001
From: wtclaude <claude@whitlocktech.net>
Date: Mon, 20 Jul 2026 23:39:12 -0500
Subject: [PATCH] fix(security): declare explicit network security config to
 forbid cleartext

The app is purely an HTTPS API client, but the manifest left
usesCleartextTraffic implicit, which SonarQube S5332 flags (cleartext is
implicitly permitted on older Android and a merged library manifest could
re-enable it). Add an explicit network security config:

- main/release: base-config cleartextTrafficPermitted="false" (no cleartext).
- debug override (app/src/debug/res/xml): re-permits cleartext to loopback
  (127.0.0.1/localhost) only, for local dev against http://127.0.0.1:3000.

This mirrors ServerUrl's rule (HTTPS required in release, HTTP allowed in
debug via allowInsecureHttp = BuildConfig.DEBUG) at the platform socket
layer. It also fixes a latent gap: at targetSdk 28+ the platform default
already blocks cleartext, so the debug loopback path only actually works
with the explicit domain-config now added.

Docs updated in RunicGateway/docs (android/PLAN.md M1).

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../debug/res/xml/network_security_config.xml | 20 +++++++++++++++++++
 app/src/main/AndroidManifest.xml              |  1 +
 .../main/res/xml/network_security_config.xml  | 16 +++++++++++++++
 3 files changed, 37 insertions(+)
 create mode 100644 app/src/debug/res/xml/network_security_config.xml
 create mode 100644 app/src/main/res/xml/network_security_config.xml

diff --git a/app/src/debug/res/xml/network_security_config.xml b/app/src/debug/res/xml/network_security_config.xml
new file mode 100644
index 0000000..c4e12a0
--- /dev/null
+++ b/app/src/debug/res/xml/network_security_config.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- SPDX-License-Identifier: GPL-3.0-or-later -->
+<!--
+  Debug-only override of the main network_security_config.xml. Keeps the secure
+  base posture (no cleartext) but re-permits cleartext to loopback so debug builds
+  can reach a local website backend at http://127.0.0.1:3000 / http://localhost:3000
+  (ServerUrl allows plain HTTP only when allowInsecureHttp = BuildConfig.DEBUG).
+  Because the platform default already blocks cleartext at targetSdk 28+, this
+  domain-config is what actually makes the debug local-dev path work at runtime.
+
+  This file is compiled only into debug builds; release builds use the main
+  source set's config and permit no cleartext at all.
+-->
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false" />
+    <domain-config cleartextTrafficPermitted="true">
+        <domain includeSubdomains="false">127.0.0.1</domain>
+        <domain includeSubdomains="false">localhost</domain>
+    </domain-config>
+</network-security-config>
diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 27b167e..78778d4 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -20,6 +20,7 @@
         android:fullBackupContent="@xml/backup_rules"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
         android:theme="@style/Theme.RunicGateway">
diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 0000000..9aac908
--- /dev/null
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- SPDX-License-Identifier: GPL-3.0-or-later -->
+<!--
+  The app is purely an HTTPS API client of a shard's website backend, so the base
+  posture forbids all cleartext (HTTP) traffic. This makes explicit what minSdk 29 /
+  targetSdk 35 already default to, satisfies the "usesCleartextTraffic implicitly
+  enabled" scanner finding, and stops any merged library manifest from re-enabling
+  cleartext. It also mirrors ServerUrl's release-build rule (HTTPS required) at the
+  platform socket layer — defense in depth.
+
+  The debug variant overrides this file (app/src/debug/res/xml/) to re-permit
+  cleartext to loopback only, for local dev against http://127.0.0.1:3000.
+-->
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false" />
+</network-security-config>
-- 
2.49.1