Svorka/PONGo_android
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

harden/security-and-review-fixes #1

Open
jvanvik wants to merge 3 commits from harden/security-and-review-fixes into main
pull from: harden/security-and-review-fixes
merge into: Svorka:main
Conversation 0 Commits 3 Files changed 21 +512 -191
jvanvik commented 2026-05-31 15:51:26 +00:00
Owner
Copy link
No description provided.
jvanvik added 3 commits 2026-05-31 15:51:26 +00:00 
Outcome of a full multi-agent code review. Touches TLS, credential storage,
API versioning, networking correctness, concurrency/lifecycle, and the release
build. See CHANGELOG.md for the full list and the items to port to the iOS app.

Security
- Remove untrusted-TLS support: delete ServerTrustPolicy.AllowSelfSignedForHost
  and its trust-all X509TrustManager; drop the self-signed Settings toggle.
- Enforce HTTPS in normalizedBaseUrl (reject http + embedded credentials);
  add network_security_config (no cleartext, system CAs only) + allowBackup=false.
- Never persist passwords at rest: remember-me stores email only; no password
  pre-fill; clear creds on sign-out / when remember-me is off.
- Match CSRF host lookup to OkHttp's host parsing; stop leaking raw exception text.

Correctness
- Fix API versioning: hardcode v1/v3 per endpoint (docs Sec.4) instead of one
  broken global apiVersion; remove the version plumbing + Settings field.
- Treat "warning" status as success (committed write); fail-fast on a missing
  pagination cursor; close Response on cancellation; tolerant JSON parse; User-Agent.
- Firmware isCompatible fails closed + extra acknowledgment for a non-compatible image.

Concurrency / lifecycle
- Run network I/O on Dispatchers.IO; stale-result generation guards + rethrow
  CancellationException in all loads; host AppState in a ViewModel (survive config
  change); thread-safe cookie jar; reset/upgrade re-entry guard; wire list Retry.

Build
- Enable R8 minify+shrink with kotlinx.serialization keep rules; drop unused
  navigation-compose; add the missing .gitignore.

NOTE: built/verified by static review only (no Android SDK on the dev machine) —
run :app:assembleDebug and a release build before shipping.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Enabling R8 in the previous commit surfaced two build issues; fixed here so
assembleDebug AND assembleRelease both succeed (verified on this machine:
Android Studio JBR 21 + SDK android-36).

- proguard-rules.pro: add `-dontwarn com.google.errorprone.annotations.**`.
  Tink (pulled in by androidx.security-crypto / EncryptedSharedPreferences)
  references compile-only Error Prone annotations that aren't on the runtime
  classpath, which R8 treated as fatal "missing class" errors.
- ApiClient.await(): @OptIn(ExperimentalCoroutinesApi::class) for the
  resume(value){ onCancellation } overload (experimental in coroutines 1.8.1).

Release APK is R8-shrunk (~1.8 MB vs ~18 MB debug). It is unsigned — wire a
signing config / keystore (kept out of VCS) before distributing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
dist/PONGo-1.0-release-unsigned.apk — output of `./gradlew :app:assembleRelease`.
Unsigned (no signing config in VCS); sign with your release keystore via
`apksigner` before installing/distributing. Rebuild any time with assembleRelease.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin harden/security-and-review-fixes:harden/security-and-review-fixes
git checkout harden/security-and-review-fixes

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git checkout main
git merge --no-ff harden/security-and-review-fixes
git checkout harden/security-and-review-fixes
git rebase main
git checkout main
git merge --ff-only harden/security-and-review-fixes
git checkout harden/security-and-review-fixes
git rebase main
git checkout main
git merge --no-ff harden/security-and-review-fixes
git checkout main
git merge --squash harden/security-and-review-fixes
git checkout main
git merge --ff-only harden/security-and-review-fixes
git checkout main
git merge harden/security-and-review-fixes
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Svorka/PONGo_android#1
No description provided.
Delete branch "harden/security-and-review-fixes"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?