mirror of
https://github.com/silkimen/cordova-plugin-advanced-http.git
synced 2024-10-06 17:22:12 +08:00
Fix #172: plugin does not respect user installed CA certs on Android
This commit is contained in:
parent
49f219723d
commit
a195de409d
@ -1,5 +1,13 @@
|
||||
# Changelog
|
||||
|
||||
## 2.0.3
|
||||
|
||||
- Fixed #172: plugin does not respect user installed CA certs on Android
|
||||
|
||||
#### Important information
|
||||
We've changed a default behavior on Android. User installed CA certs are respected now.
|
||||
If you don't want this for your needs, you can switch back to old behavior by setting SSL cert mode to `legacy`.
|
||||
|
||||
## 2.0.2
|
||||
|
||||
- Fixed #142: Plugin affected by REDoS Issue of tough-cookie
|
||||
|
@ -132,12 +132,13 @@ These functions all take success and error callbacks as their last 2 arguments.
|
||||
Set SSL Cert handling mode, being one of the following values:
|
||||
|
||||
* `default`: default SSL cert handling using system's CA certs
|
||||
* `legacy`: use legacy default behavior (< 2.0.3), excluding user installed CA certs (only for Android)
|
||||
* `nocheck`: disable SSL cert checking, trusting all certs (meant to be used only for testing purposes)
|
||||
* `pinned`: trust only provided certs
|
||||
|
||||
To use SSL pinning you must include at least one `.cer` SSL certificate in your app project. You can pin to your server certificate or to one of the issuing CA certificates. Include your certificate in the `www/certificates` folder. All `.cer` files found there will be loaded automatically.
|
||||
|
||||
:warning: Your certificate must be DER encoded! If you only have a PEM enoceded certificate see this [stackoverflow answer](http://stackoverflow.com/a/16583429/3182729). You want to convert it to a DER encoded certificate with a .cer extension.
|
||||
:warning: Your certificate must be DER encoded! If you only have a PEM encoded certificate read this [stackoverflow answer](http://stackoverflow.com/a/16583429/3182729). You want to convert it to a DER encoded certificate with a .cer extension.
|
||||
|
||||
```js
|
||||
// enable SSL pinning
|
||||
|
@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "cordova-plugin-advanced-http",
|
||||
"version": "2.0.2",
|
||||
"version": "2.0.3",
|
||||
"description": "Cordova / Phonegap plugin for communicating with HTTP servers using SSL pinning",
|
||||
"scripts": {
|
||||
"updatecert": "node ./scripts/update-test-cert.js",
|
||||
|
@ -8,8 +8,11 @@ import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
|
||||
import java.security.GeneralSecurityException;
|
||||
import java.security.KeyStore;
|
||||
import java.security.cert.Certificate;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.Enumeration;
|
||||
|
||||
import org.apache.cordova.CallbackContext;
|
||||
import org.apache.cordova.CordovaInterface;
|
||||
@ -89,7 +92,7 @@ public class CordovaHttpPlugin extends CordovaPlugin {
|
||||
} else if (action.equals("setSSLCertMode")) {
|
||||
String mode = args.getString(0);
|
||||
|
||||
if (mode.equals("default")) {
|
||||
if (mode.equals("legacy")) {
|
||||
HttpRequest.setSSLCertMode(HttpRequest.CERT_MODE_DEFAULT);
|
||||
callbackContext.success();
|
||||
} else if (mode.equals("nocheck")) {
|
||||
@ -104,6 +107,15 @@ public class CordovaHttpPlugin extends CordovaPlugin {
|
||||
e.printStackTrace();
|
||||
callbackContext.error("There was an error setting up ssl pinning");
|
||||
}
|
||||
} else if (mode.equals("default")) {
|
||||
try {
|
||||
this.loadUserStoreSSLCerts();
|
||||
HttpRequest.setSSLCertMode(HttpRequest.CERT_MODE_PINNED);
|
||||
callbackContext.success();
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
callbackContext.error("There was an error loading system's CA certificates");
|
||||
}
|
||||
}
|
||||
} else if (action.equals("uploadFile")) {
|
||||
String urlString = args.getString(0);
|
||||
@ -134,6 +146,16 @@ public class CordovaHttpPlugin extends CordovaPlugin {
|
||||
return true;
|
||||
}
|
||||
|
||||
private void loadUserStoreSSLCerts() throws Exception {
|
||||
KeyStore ks = KeyStore.getInstance("AndroidCAStore");
|
||||
ks.load(null);
|
||||
Enumeration<String> aliases = ks.aliases();
|
||||
|
||||
while (aliases.hasMoreElements()) {
|
||||
String alias = aliases.nextElement();
|
||||
}
|
||||
}
|
||||
|
||||
private void loadSSLCerts() throws GeneralSecurityException, IOException {
|
||||
AssetManager assetManager = cordova.getActivity().getAssets();
|
||||
String[] files = assetManager.list("www/certificates");
|
||||
|
@ -124,7 +124,7 @@
|
||||
- (void)setSSLCertMode:(CDVInvokedUrlCommand*)command {
|
||||
NSString *certMode = [command.arguments objectAtIndex:0];
|
||||
|
||||
if ([certMode isEqualToString: @"default"]) {
|
||||
if ([certMode isEqualToString: @"default"] || [certMode isEqualToString: @"legacy"]) {
|
||||
securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeNone];
|
||||
securityPolicy.allowInvalidCertificates = NO;
|
||||
securityPolicy.validatesDomainName = YES;
|
||||
|
@ -3,7 +3,7 @@ var cookieHandler = require(pluginId + '.cookie-handler');
|
||||
var messages = require(pluginId + '.messages');
|
||||
|
||||
var validSerializers = [ 'urlencoded', 'json', 'utf8' ];
|
||||
var validCertModes = [ 'default', 'nocheck', 'pinned' ];
|
||||
var validCertModes = [ 'default', 'nocheck', 'pinned', 'legacy' ];
|
||||
var validHttpMethods = [ 'get', 'put', 'post', 'patch', 'head', 'delete', 'upload', 'download' ];
|
||||
|
||||
module.exports = {
|
||||
|
Loading…
Reference in New Issue
Block a user