🛡️ Sentinel: [security improvement] Disable app backups and cleartext traffic

.jules/sentinel.md

@@ -2,3 +2,7 @@
 **Vulnerability:** OAuth state parameter used a predictable `System.currentTimeMillis()` value, vulnerable to CSRF attacks.
 **Learning:** Always use a cryptographically secure random value for OAuth state parameter and persist it across process boundaries using shared preferences or similar mechanisms to verify during the callback.
 **Prevention:** Follow OAuth 2.0 security guidelines and utilize `java.security.SecureRandom` or UUIDs to generate state parameters, ensuring they are verified in the callback process.
+## 2024-05-31 - [Android Manifest Security Baseline]
+**Vulnerability:** Weak default Android application security settings (`allowBackup="true"` implicitly allowed, `usesCleartextTraffic` implicitly allowed on older APIs).
+**Learning:** The application was vulnerable to data extraction (including sensitive OAuth tokens) via adb backup and Man-In-The-Middle (MITM) attacks for unencrypted traffic.
+**Prevention:** Explicitly set `android:allowBackup="false"` and `android:usesCleartextTraffic="false"` in `AndroidManifest.xml` unless there is a specific, well-justified reason to enable them.

app/src/main/AndroidManifest.xml

@@ -3,9 +3,11 @@
 
     <uses-permission android:name="android.permission.INTERNET" />
 
+    <!-- Sentinel Security: Disable backups to prevent extraction of OAuth tokens and use cleartext traffic false to prevent MITM -->
     <application
         android:name=".RdTubeApp"
-        android:allowBackup="true"
+        android:allowBackup="false"
+        android:usesCleartextTraffic="false"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"

app/src/main/java/com/example/reddittube/ui/main/components/MinimalButton.kt

@@ -16,7 +16,6 @@ import androidx.compose.ui.draw.clip
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.semantics.Role
 import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.semantics.Role
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
 

app/src/main/res/values-v27/themes.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+
+    <style name="Theme.RdTube" parent="android:Theme.Material.Light.NoActionBar">
+        <item name="android:windowBackground">@drawable/splash_background</item>
+        <item name="android:statusBarColor">@android:color/black</item>
+        <item name="android:navigationBarColor">@android:color/black</item>
+        <item name="android:windowLightStatusBar">false</item>
+        <item name="android:windowLightNavigationBar">false</item>
+    </style>
+</resources>

app/src/main/res/values/themes.xml

@@ -6,6 +6,5 @@
         <item name="android:statusBarColor">@android:color/black</item>
         <item name="android:navigationBarColor">@android:color/black</item>
         <item name="android:windowLightStatusBar">false</item>
-        <item name="android:windowLightNavigationBar">false</item>
     </style>
-</resources>
+</resources>