java.android.best-practice.manifest-security-features.manifest-usesCleartextTraffic-true

profile photo of semgrepsemgrep
Author
103
Download Count*
LGPL Commons Clause
License

The Android manifest is configured to allow non-encrypted connections. Evaluate if this is necessary for your app, and disable it if appropriate. This flag is ignored on Android 7 (API 24) and above if a Network Security Config is present.

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: manifest-usesCleartextTraffic-true
    languages:
      - generic
    message: The Android manifest is configured to allow non-encrypted connections.
      Evaluate if this is necessary for your app, and disable it if appropriate.
      This flag is ignored on Android 7 (API 24) and above if a Network Security
      Config is present.
    metadata:
      category: best-practice
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      technology:
        - android
      references:
        - https://developer.android.com/guide/topics/manifest/application-element#usesCleartextTraffic
        - https://developer.android.com/training/articles/security-config
    patterns:
      - pattern: |
          android:usesCleartextTraffic="true"
      - pattern-not-inside: |
          <!-- ... -->
    severity: INFO
    paths:
      include:
        - "*.xml"

Examples

manifest-security-features.xml

<?xml version="1.0" encoding="utf-8"?>

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools"
    package="com.example.manifest-test" >
    <application
        <!-- ruleid: manifest-usesCleartextTraffic-true, manifest-usesCleartextTraffic-ignored-by-nsc -->
        android:usesCleartextTraffic="true"
        android:networkSecurityConfig="@xml/network_security_config"
        android:allowBackup="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/AppTheme"
        android:fullBackupContent="false"
        tools:ignore="GoogleAppIndexingWarning">

        <activity
            android:name="com.example.networksecurity.MainActivity"
            android:label="@string/app_name"
            android:theme="@style/AppTheme.NoActionBar">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
    </application>

</manifest>

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools"
    package="com.example.manifest-test" >
    <application
        <!-- ok: manifest-usesCleartextTraffic-ignored-by-nsc -->
        <!-- ruleid: manifest-usesCleartextTraffic-true -->
        android:usesCleartextTraffic="true"
        android:allowBackup="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/AppTheme"
        android:fullBackupContent="false"
        tools:ignore="GoogleAppIndexingWarning">

        <activity
            android:name="com.example.networksecurity.MainActivity"
            android:label="@string/app_name"
            android:theme="@style/AppTheme.NoActionBar">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
    </application>

</manifest>

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools"
    package="com.example.manifest-test" >
    <application
        <!-- ok: manifest-usesCleartextTraffic-true, manifest-usesCleartextTraffic-ignored-by-nsc -->
        android:usesCleartextTraffic="false"
        android:allowBackup="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/AppTheme"
        android:fullBackupContent="false"
        tools:ignore="GoogleAppIndexingWarning">

        <activity
            android:name="com.example.networksecurity.MainActivity"
            android:label="@string/app_name"
            android:theme="@style/AppTheme.NoActionBar">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
    </application>

</manifest>