Cleartext traffic not allowed after patching APK

[ftruzzi]

Hi,

Today I patched an APK which also has unsecured (HTTP) endpoints, and after patching the APK those API calls would be blocked by Android with ERR_CLEARTEXT_NOT_PERMITTED.

The fix was to run the script with --wait and add <base-config cleartextTrafficPermitted="true" /> to network-security-config.xml before rebuilding the APK. Could it be done automatically if the original AndroidManifest.xml enables cleartext traffic through the usesCleartextTraffic attribute?

I'm new to all of this and have no experience with Android development so not sure what else should be considered.

Thanks!

[niklashigi]

The fix was to run the script with --wait and add <base-config cleartextTrafficPermitted="true" /> to network-security-config.xml before rebuilding the APK. Could it be done automatically if the original AndroidManifest.xml enables cleartext traffic through the usesCleartextTraffic attribute?

Yeah, that seems like a reasonable fix. Thanks a lot for reporting this, I wasn't even aware of these cleartext-related options!

[ftruzzi]

Thanks!