wtclaude
26b8eecde6
All checks were successful
PR Checks / android-build (pull_request) Successful in 10m30s
The app is purely an HTTPS API client, but the manifest left usesCleartextTraffic implicit, which SonarQube S5332 flags (cleartext is implicitly permitted on older Android and a merged library manifest could re-enable it). Add an explicit network security config: - main/release: base-config cleartextTrafficPermitted="false" (no cleartext). - debug override (app/src/debug/res/xml): re-permits cleartext to loopback (127.0.0.1/localhost) only, for local dev against http://127.0.0.1:3000. This mirrors ServerUrl's rule (HTTPS required in release, HTTP allowed in debug via allowInsecureHttp = BuildConfig.DEBUG) at the platform socket layer. It also fixes a latent gap: at targetSdk 28+ the platform default already blocks cleartext, so the debug loopback path only actually works with the explicit domain-config now added. Docs updated in RunicGateway/docs (android/PLAN.md M1). Co-Authored-By: Claude <noreply@anthropic.com>
21 lines
1022 B
XML
21 lines
1022 B
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!-- SPDX-License-Identifier: GPL-3.0-or-later -->
|
|
<!--
|
|
Debug-only override of the main network_security_config.xml. Keeps the secure
|
|
base posture (no cleartext) but re-permits cleartext to loopback so debug builds
|
|
can reach a local website backend at http://127.0.0.1:3000 / http://localhost:3000
|
|
(ServerUrl allows plain HTTP only when allowInsecureHttp = BuildConfig.DEBUG).
|
|
Because the platform default already blocks cleartext at targetSdk 28+, this
|
|
domain-config is what actually makes the debug local-dev path work at runtime.
|
|
|
|
This file is compiled only into debug builds; release builds use the main
|
|
source set's config and permit no cleartext at all.
|
|
-->
|
|
<network-security-config>
|
|
<base-config cleartextTrafficPermitted="false" />
|
|
<domain-config cleartextTrafficPermitted="true">
|
|
<domain includeSubdomains="false">127.0.0.1</domain>
|
|
<domain includeSubdomains="false">localhost</domain>
|
|
</domain-config>
|
|
</network-security-config>
|