forcedotcom / SalesforceMobileSDK-Android

Android SDK for Salesforce
Other
339 stars 384 forks source link

@W-14893505: [ASA Program] [#SA-01][Android] App Enables Dangerous File Access via setAllowFileAccessFromFileURLs #2546

Closed JohnsonEricAtSalesforce closed 2 months ago

JohnsonEricAtSalesforce commented 2 months ago

🎸 Ready For Review! 🥁

This removes file URL access from the login web view to comply with the security goal of this work item. This was discussed among the team today and there doesn't seem to be a known reason for why this is enabled. The login use cases I tried today all seem to function just as well without this option. If anyone has login edge cases that might have been affected, do let me know and I'll investigate.

Thanks!

mobilesdk-bot commented 2 months ago
1 Error
:no_entry_sign: Tests have failed, see below for more information.

Tests:

Name Classname Time
testDecryptDataEncryptedWithNewRSACipherForKeyCreatedBeforeUpgrade com.salesforce.androidsdk.security.KeyStoreWrapperTest 0.118
testDecryptDataEncryptedWithNewRSACipher com.salesforce.androidsdk.security.KeyStoreWrapperTest 0.042
testRSAOAEPSHA256EncryptDecrypt com.salesforce.androidsdk.security.KeyStoreWrapperTest 0.069

Tests results for SalesforceSDK

Generated by :no_entry_sign: Danger