build: enable http #162
build: enable http #162
Conversation
WalkthroughThis pull request enhances network configuration and URL generation. It updates the Android manifest to reference a new network security configuration file and adds that XML file, which permits cleartext traffic and uses system trust anchors. Additionally, the BaseApplication’s Changes
Sequence Diagram(s)sequenceDiagram
participant App as Application
participant OS as Android OS
participant FS as File System
participant BA as BaseApplication
App->>OS: Load AndroidManifest.xml
OS->>OS: Read networkSecurityConfig attribute (@xml/network_security_config)
OS->>FS: Retrieve network_security_config.xml
FS-->>OS: Return network config (cleartextTrafficPermitted, trust anchors)
OS-->>App: Apply network security settings
App->>BA: Call getBaseUrl()
BA-->>App: Return HTTP base URL (with updated example URLs)
✨ Finishing Touches
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
app/src/main/java/ai/elimu/content_provider/BaseApplication.java (1)
30-31: Update example URLs in comment to match HTTP protocol.The comment examples still use the HTTPS protocol, but the implementation has changed to use HTTP. For consistency, the comment should reflect the actual protocol being used in the code.
- * E.g. "https://eng.elimu.ai" or "https://hin.elimu.ai" + * E.g. "http://eng.elimu.ai" or "http://hin.elimu.ai"app/src/main/AndroidManifest.xml (1)
9-17: Consider adding a TODO comment about reverting the network security configuration.Similar to the code change, this manifest modification should be considered temporary. It would be helpful to add a comment in the manifest to indicate that this configuration should be removed once SSL is implemented.
<application + <!-- TODO: Remove network security config once SSL is implemented (issue #1694) --> android:networkSecurityConfig="@xml/network_security_config" android:name=".BaseApplication"
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
app/src/main/AndroidManifest.xml(1 hunks)app/src/main/java/ai/elimu/content_provider/BaseApplication.java(1 hunks)app/src/main/res/xml/network_security_config.xml(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- app/src/main/res/xml/network_security_config.xml
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: build (windows-latest, 21)
- GitHub Check: build (windows-latest, 17)
- GitHub Check: build (ubuntu-latest, 17)
| */ | ||
| public String getBaseUrl() { | ||
| Language language = SharedPreferencesHelper.getLanguage(getApplicationContext()); | ||
| String url = "https://" + language.getIsoCode(); | ||
| String url = "http://" + language.getIsoCode(); |
There was a problem hiding this comment.
💡 Verification agent
❓ Verification inconclusive
Downgrading from HTTPS to HTTP introduces security risks.
Changing from HTTPS to HTTP removes transport layer security, exposing data to potential eavesdropping and man-in-the-middle attacks. While this is acceptable as a temporary measure (per PR description "temporarily enable the use of http:// for the backend until SSL is implemented"), it's recommended to add a TODO comment to ensure this gets reverted once SSL is implemented.
- String url = "http://" + language.getIsoCode();
+ // TODO: Revert back to HTTPS once SSL is implemented in the backend (see issue #1694)
+ String url = "http://" + language.getIsoCode();Action: Add a TODO for HTTPS reversion when SSL is implemented
The temporary downgrade to HTTP is acceptable per the PR description but still introduces security risks by removing transport layer protection. To mitigate this risk, please add a TODO comment indicating that this change should be reverted once SSL is implemented.
- File:
app/src/main/java/ai/elimu/content_provider/BaseApplication.java(Line 35) - Required Change:
- Add a TODO comment above the URL assignment to remind reverting to HTTPS when backend SSL is in place.
Diff snippet for clarity:
- String url = "http://" + language.getIsoCode();
+ // TODO: Revert back to HTTPS once SSL is implemented in the backend (see issue #1694)
+ String url = "http://" + language.getIsoCode();📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| String url = "http://" + language.getIsoCode(); | |
| // TODO: Revert back to HTTPS once SSL is implemented in the backend (see issue #1694) | |
| String url = "http://" + language.getIsoCode(); |
| @@ -7,6 +7,7 @@ | |||
| <permission android:name="${applicationId}.provider.READ" /> | |||
|
|
|||
| <application | |||
| android:networkSecurityConfig="@xml/network_security_config" | |||
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Verify the network security configuration file exists and is properly configured.
Adding a network security configuration is necessary to allow HTTP cleartext traffic, which modern Android versions block by default. However, we should ensure that:
- The referenced XML file (
@xml/network_security_config) exists in the project - The configuration is properly set up to only allow cleartext traffic for specific domains
- This configuration is also temporary and will be removed once SSL is implemented
🏁 Script executed:
#!/bin/bash
# Check if the network_security_config.xml file exists
if [ -f "app/src/main/res/xml/network_security_config.xml" ]; then
echo "✅ network_security_config.xml file exists."
# Display the content of the file
echo "Content of network_security_config.xml:"
cat app/src/main/res/xml/network_security_config.xml
else
echo "❌ network_security_config.xml file does not exist!"
fiLength of output: 553
Action Required: Update Network Security Configuration to Restrict Cleartext Traffic
- The
network_security_config.xmlfile was found atapp/src/main/res/xml/network_security_config.xml. - The current configuration in the file uses a
<base-config>withcleartextTrafficPermitted="true", which enables cleartext traffic globally rather than for specific domains. - Recommendation: Update the configuration to restrict HTTP cleartext traffic to only those domains that require it. Also, document that this setup is temporary and will be removed once SSL is implemented.
Temporarily enable
http://until SSL gets enabled for the backend: elimu-ai/webapp#1694Summary by CodeRabbit