🔒 Security Fix: Remove insecure 'Ignore SSL Errors' option#28
Conversation
- Removed custom TrustManager and HostnameVerifier in NetworkModule.kt that allowed bypassing SSL validation. - Removed `ignoreSslErrors` preference from PreferencesManager.kt and associated UI in LibraryDrawerContent.kt. - Cleaned up BaseJsoupSource.kt and ReaderScreen.kt to use standard secure connections. - Added LibraryViewModelTest.kt to verify ViewModel integrity. This fixes a security vulnerability where SSL validation could be disabled, exposing users to MITM attacks. Co-authored-by: Aatricks <113598245+Aatricks@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
This PR addresses a critical security vulnerability by removing the "Ignore SSL Errors" feature.
Previously, the app allowed users to disable SSL certificate validation, which could be exploited to intercept secure traffic.
Changes:
TrustManagerandHostnameVerifierlogic. TheOkHttpClientnow uses the system's default secure configuration.ignoreSslErrorsproperty and storage key.SSLContextbased on the preference.LibraryDrawerContent.kt) and the corresponding state inLibraryViewModel.kt.CloudflareDialogto rely on standard WebView SSL handling (which blocks invalid certs by default).LibraryViewModelTest.ktto ensure the ViewModel remains stable after removing the dependency. Validated with existing unit tests.Risk Assessment:
PR created automatically by Jules for task 860067918690827876 started by @Aatricks