Add certificate pinning security

tchapgouv · Aug 29, 2024 · 75b604e · 75b604e
1 parent d372697
commit 75b604e
Show file tree

Hide file tree

Showing 5 changed files with 29 additions and 2 deletions.
diff --git a/.../main/res/xml/network_security_config.xml → ...droid/res/xml/network_security_config.xml b/.../main/res/xml/network_security_config.xml → ...droid/res/xml/network_security_config.xml
diff --git a/app/src/gplay/res/raw/certignaservicesrootca.cer b/app/src/gplay/res/raw/certignaservicesrootca.cer
diff --git a/app/src/gplay/res/xml/network_security_config.xml b/app/src/gplay/res/xml/network_security_config.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <!-- Do not allow clearText traffic -->
+    <base-config cleartextTrafficPermitted="false">
+        <trust-anchors>
+            <!-- Do not allow system and user certificates by default -->
+
+            <!-- Allow only Tchap intermediate certificate authority -->
+            <certificates src="@raw/certignaservicesrootca" />
+        </trust-anchors>
+    </base-config>
+
+    <!-- Allow system certificates for firebase if used. No effect on FDroid variant -->
+    <domain-config cleartextTrafficPermitted="false">
+        <domain includeSubdomains="false">firebaseinstallations.googleapis.com</domain>
+        <trust-anchors>
+            <certificates src="system" />
+        </trust-anchors>
+    </domain-config>
+
+    <debug-overrides>
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="user" />
+        </trust-anchors>
+    </debug-overrides>
+</network-security-config>
diff --git a/...kotlin/io/element/android/features/rageshake/impl/crash/VectorUncaughtExceptionHandler.kt b/...kotlin/io/element/android/features/rageshake/impl/crash/VectorUncaughtExceptionHandler.kt
@@ -47,7 +47,7 @@ class VectorUncaughtExceptionHandler(
     override fun uncaughtException(thread: Thread, throwable: Throwable) {
         Timber.v("Uncaught exception: $throwable")
         val bugDescription = buildString {
-            val appName = "ElementX"
+            val appName = "TchapX"
             // append(appName + " Build : " + versionCodeProvider.getVersionCode() + "\n")
             append("$appName Version : 1.0") // ${versionProvider.getVersion(longFormat = true)}\n")
             // append("SDK Version : ${Matrix.getSdkVersion()}\n")

diff --git a/settings.gradle.kts b/settings.gradle.kts
@@ -67,7 +67,7 @@ dependencyResolutionManagement {
 
 enableFeaturePreview("TYPESAFE_PROJECT_ACCESSORS")
 
-rootProject.name = "ElementX"
+rootProject.name = "TchapX"
 include(":app")
 include(":appnav")
 include(":appconfig")