wtclaude
26b8eecde6
All checks were successful
PR Checks / android-build (pull_request) Successful in 10m30s
The app is purely an HTTPS API client, but the manifest left usesCleartextTraffic implicit, which SonarQube S5332 flags (cleartext is implicitly permitted on older Android and a merged library manifest could re-enable it). Add an explicit network security config: - main/release: base-config cleartextTrafficPermitted="false" (no cleartext). - debug override (app/src/debug/res/xml): re-permits cleartext to loopback (127.0.0.1/localhost) only, for local dev against http://127.0.0.1:3000. This mirrors ServerUrl's rule (HTTPS required in release, HTTP allowed in debug via allowInsecureHttp = BuildConfig.DEBUG) at the platform socket layer. It also fixes a latent gap: at targetSdk 28+ the platform default already blocks cleartext, so the debug loopback path only actually works with the explicit domain-config now added. Docs updated in RunicGateway/docs (android/PLAN.md M1). Co-Authored-By: Claude <noreply@anthropic.com>
17 lines
822 B
XML
17 lines
822 B
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!-- SPDX-License-Identifier: GPL-3.0-or-later -->
|
|
<!--
|
|
The app is purely an HTTPS API client of a shard's website backend, so the base
|
|
posture forbids all cleartext (HTTP) traffic. This makes explicit what minSdk 29 /
|
|
targetSdk 35 already default to, satisfies the "usesCleartextTraffic implicitly
|
|
enabled" scanner finding, and stops any merged library manifest from re-enabling
|
|
cleartext. It also mirrors ServerUrl's release-build rule (HTTPS required) at the
|
|
platform socket layer — defense in depth.
|
|
|
|
The debug variant overrides this file (app/src/debug/res/xml/) to re-permit
|
|
cleartext to loopback only, for local dev against http://127.0.0.1:3000.
|
|
-->
|
|
<network-security-config>
|
|
<base-config cleartextTrafficPermitted="false" />
|
|
</network-security-config>
|