search

GRizzi91 / bouquet

PDF reader Android library based on Jetpack Compose
Apache License 2.0
152 stars 32 forks source link

Error: checkServerTrusted is empty #42

Open saenic opened 1 year ago

saenic commented 1 year ago

My lint keeps throwing an error when I use your library: /Users/saenic/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcpkix-jdk15to18/1.75/f16e5252ad7a46d5eaf255231b0a5da307599082/bcpkix-jdk15to18-1.75.jar: Error: checkServerTrusted is empty, which could cause insecure network traffic due to trusting arbitrary TLS/SSL certificates presented by peers [TrustAllX509TrustManager]

I looked through your code and couldn't find any trust manager implementations, so no clue why this occurs. Maybe you can find the source of the problem.

GRizzi91 commented 1 year ago

@saenic did you use Bouncy Castel in your app?

saenic commented 1 year ago

No I don't, but you are. I found out, that the "com.tom-roush:pdfbox-android" library you embedded is using Bouncy Castle. Since you only need this PDF Box for accessibility you might reconsider using it.

GRizzi91 commented 1 year ago

@saenic I'm very sorry, the accessibility feature was added by an external contributor and I didn't get to make a dependency tree. However I think I will exclude the accessibility feature from the official release and create a parallel release to continue to support accessibility. Even if it will cost me in maintenance.

kartikprakash1 commented 10 months ago

@GRizzi91 any updates on this? I'm getting the following error because of bouncycastle I assume

SHA-256 digest error for org/bouncycastle/cert/AttributeCertificateHolder.class
kartikprakash1 commented 10 months ago

Looks like for now excluding bouncycastle works as a workaround

implementation("io.github.grizzi91:bouquet:1.1.2") {
        exclude("org.bouncycastle")
    }