search

wizmer / syncorg

An implementation of MobileOrg for the Android platform
GNU General Public License v3.0
174 stars 23 forks source link

insecure gradlew #61

Open IzzySoft opened 5 years ago

IzzySoft commented 5 years ago

in case this project is still maintained: a minor fix would be required to increase build security. F-Droid lint complains:

Found plain HTTP URL for gradle repository:
build/com.coste.syncorg/SyncOrg/build.gradle
repositories {
    maven { url 'http://guardian.github.com/maven/repo-releases' }
gradle build uses plain HTTP URLs for repositories!  This is insecure!
https://max.computer/blog/how-to-take-over-the-computer-of-any-java-or-clojure-or-scala-developer/

Simply make that an https URL, the target supports that. Thanks!