search

cbeyls / fosdem-companion-android

FOSDEM Companion for Android
Apache License 2.0
136 stars 93 forks source link

Network connection may not be being verified in project #69

Closed amazuerar closed 5 months ago

amazuerar commented 2 years ago

Dear Developer!

My name is Alejandro Mazuera-Rozo, I am a PhD Student at Universidad de los Andes, and at Università della Svizzera italiana. I am part of a research on the usage of network libraries within android apps. As a result of this we identified that there is a missing validation of network connection within the project since some network operations are being performed in the application.

As you might know, a device may not be connected to a network. In order to get such information see https://developer.android.com/reference/android/net/ConnectivityManager. Therefore it is recommended for the app to identify whether the device has a network connection available before performing a network operation.

In order to address this issue we recommend you to visit:

  1. https://developer.android.com/training/basics/network-ops/managing
  2. https://developer.android.com/reference/android/net/ConnectivityManager.NetworkCallback

Note: public NetworkInfo getActiveNetworkInfo () returns details about the currently active default data network. When connected, this network is the default route for outgoing connections. You should always check NetworkInfo#isConnected() before initiating network traffic, it requires Manifest.permission.ACCESS_NETWORK_STATE. However, isConnected() was deprecated in API level 29, one should instead use the ConnectivityManager.NetworkCallback API to learn about connectivity changes, to be more specific the onAvailable() method.

cbeyls commented 2 years ago

This app is designed to work offline. Without connectivity, it still works fine because all data is loaded from a database.

If the app was not offline-first, it would make sense to test connectivity and display a persistent message inviting the user to connect in order to be able to use the app.

In case of network error or no connectivity during a request to update the database, the app shows a simple error message saying the data could not be loaded, then resumes normally. In practice, checking the connectivity before performing the network request or not doing it will not change the outcome: showing an error message. So I don't see any added value for the end user.