allow cleartext and introduce preference option disabling HTTP by default but making it configurable by user. for all the users who are in LAN/VPN. closes #2966

Author: PhilippC

src/Kp2aBusinessLogic/Io/WebDavFileStorage.cs

@@ -19,7 +19,7 @@ namespace keepass2android.Io
 #if !NoNet && !EXCLUDE_JAVAFILESTORAGE
 	public class WebDavFileStorage: JavaFileStorage
 	{
-		public WebDavFileStorage(IKp2aApp app) : base(new Keepass2android.Javafilestorage.WebDavStorage(app.CertificateErrorHandler), app)
+		public WebDavFileStorage(IKp2aApp app, Context appContext) : base(new Keepass2android.Javafilestorage.WebDavStorage(app.CertificateErrorHandler, appContext), app)
 		{
 		}
 

src/java/JavaFileStorage/app/src/main/java/keepass2android/javafilestorage/WebDavStorage.java

@@ -3,7 +3,6 @@
 import android.content.Context;
 import android.content.Intent;
 
-import android.net.Uri;
 import android.os.Bundle;
 import android.preference.PreferenceManager;
 import android.util.Log;
@@ -15,7 +14,11 @@
 import com.burgstaller.okhttp.digest.CachingAuthenticator;
 import com.burgstaller.okhttp.digest.DigestAuthenticator;
 
+import okhttp3.Interceptor;
+import okhttp3.Response;
+import okhttp3.Request;
 import java.io.FileNotFoundException;
+import java.io.IOException;
 import java.io.InputStream;
 import java.io.StringReader;
 import java.io.UnsupportedEncodingException;
@@ -38,25 +41,43 @@
 import javax.net.ssl.TrustManagerFactory;
 import javax.net.ssl.X509TrustManager;
 
-import keepass2android.javafilestorage.ConnectionInfo;
 import keepass2android.javafilestorage.webdav.DecoratedHostnameVerifier;
 import keepass2android.javafilestorage.webdav.DecoratedTrustManager;
 import keepass2android.javafilestorage.webdav.PropfindXmlParser;
 import keepass2android.javafilestorage.webdav.WebDavUtil;
 import okhttp3.MediaType;
 import okhttp3.OkHttpClient;
-import okhttp3.Request;
 import okhttp3.RequestBody;
-import okhttp3.Response;
 import okhttp3.internal.tls.OkHostnameVerifier;
 
 public class WebDavStorage extends JavaFileStorageBase {
 
+
+    public class CleartextBlockInterceptor implements Interceptor {
+        private final boolean permitCleartext;
+
+        public CleartextBlockInterceptor(Context context) {
+            this.permitCleartext = PreferenceManager.getDefaultSharedPreferences(context).getBoolean("permit_cleartext_traffic", false);
+        }
+
+        @Override
+        public Response intercept(Chain chain) throws IOException {
+            Request request = chain.request();
+
+            if (!permitCleartext && request.url().scheme().equals("http")) {
+                throw new IOException("Cleartext HTTP is disabled by user preference. Go to app settings/File handling if you really want to use HTTP.");
+            }
+
+            return chain.proceed(request);
+        }
+    }
+
     private final ICertificateErrorHandler mCertificateErrorHandler;
     private Context appContext;
 
-    public WebDavStorage(ICertificateErrorHandler certificateErrorHandler)
+    public WebDavStorage(ICertificateErrorHandler certificateErrorHandler, Context appContext)
     {
+        this.appContext = appContext;
 
         mCertificateErrorHandler = certificateErrorHandler;
     }
@@ -174,6 +195,7 @@ private OkHttpClient getClient(ConnectionInfo ci) throws NoSuchAlgorithmExceptio
             builder.readTimeout(25, TimeUnit.SECONDS);
             builder.writeTimeout(25, TimeUnit.SECONDS);
         }
+        builder.addInterceptor(new CleartextBlockInterceptor(appContext));
 
         OkHttpClient client =  builder.build();
 
@@ -514,7 +536,6 @@ public void onActivityResult(FileStorageSetupActivity activity,
 
     @Override
     public void prepareFileUsage(Context appContext, String path) {
-        this.appContext = appContext;
 
     }
 

src/keepass2android-app/FileSelectHelper.cs

@@ -319,7 +319,7 @@ private void ShowHttpDialog(Activity activity, Util.FileSelectedHandler onStartB
 			View dlgContents = activity.LayoutInflater.Inflate(Resource.Layout.httpcredentials, null);
 		    if (!defaultPath.EndsWith(_schemeSeparator))
 		    {
-		        var webdavStorage = new Keepass2android.Javafilestorage.WebDavStorage(App.Kp2a.CertificateErrorHandler);
+		        var webdavStorage = new Keepass2android.Javafilestorage.WebDavStorage(App.Kp2a.CertificateErrorHandler, App.Context);
 		        var connInfo = webdavStorage.SplitStringToConnectionInfo(defaultPath);
 		        dlgContents.FindViewById<EditText>(Resource.Id.http_url).Text = connInfo.Url;
 		        dlgContents.FindViewById<EditText>(Resource.Id.http_user).Text = connInfo.Username;
@@ -339,7 +339,7 @@ private void ShowHttpDialog(Activity activity, Util.FileSelectedHandler onStartB
 										  string scheme = defaultPath.Substring(0, defaultPath.IndexOf(_schemeSeparator, StringComparison.Ordinal));
 										  if (host.Contains(_schemeSeparator) == false)
 											  host = scheme + _schemeSeparator + host;
-										  string httpPath = new Keepass2android.Javafilestorage.WebDavStorage(null).BuildFullPath(host, user,
+										  string httpPath = new Keepass2android.Javafilestorage.WebDavStorage(null, App.Context).BuildFullPath(host, user,
 																										  password);
 										  onStartBrowse(httpPath);
 									  });
@@ -518,7 +518,7 @@ private void ShowOwncloudDialog(Activity activity, Util.FileSelectedHandler onSt
 										  string scheme = defaultPath.Substring(0,defaultPath.IndexOf(_schemeSeparator, StringComparison.Ordinal));
 										  if (host.Contains(_schemeSeparator) == false)
 											  host = scheme + _schemeSeparator + host;
-										  string httpPath = new Keepass2android.Javafilestorage.WebDavStorage(null).BuildFullPath(WebDavFileStorage.Owncloud2Webdav(host, subtype == "owncloud" ? WebDavFileStorage.owncloudPrefix : WebDavFileStorage.nextcloudPrefix), user,
+										  string httpPath = new Keepass2android.Javafilestorage.WebDavStorage(null, App.Context).BuildFullPath(WebDavFileStorage.Owncloud2Webdav(host, subtype == "owncloud" ? WebDavFileStorage.owncloudPrefix : WebDavFileStorage.nextcloudPrefix), user,
 																										  password);
 										  onStartBrowse(httpPath);
 									  });

src/keepass2android-app/Resources/values/config.xml

@@ -125,6 +125,9 @@
 	<string name="QuickUnlockIconHidden16_key">QuickUnlockIconHidden16_key</string>
 	<string name="QuickUnlockBlockedWhenDeviceNotSecure_key">QuickUnlockBlockedWhenDeviceNotSecure_key</string>
 
+	<!-- Note: this key is used in WebDavStorage.java -->
+	<string name="cleartextTrafficPermitted_key">permit_cleartext_traffic</string> 
+	
 	<string name="UsageCount_key">UsageCount</string>
 	<string name="LastInfoVersionCode_key">LastInfoVersion</string>
 

src/keepass2android-app/Resources/values/strings.xml

@@ -731,6 +731,8 @@
   <string name="EntryChannel_desc">Notification to simplify access to the currently selected entry.</string>
   <string name="CloseDbAfterFailedAttempts">Close database after three failed biometric unlock attempts.</string>
   <string name="WarnFingerprintInvalidated">Warning! Biometric authentication can be invalidated by Android, e.g. after adding a new fingerprint in your device settings. Make sure you always know how to unlock with your master password!</string>
+  <string name="cleartextTrafficPermitted_title">Allow clear-text network traffic in WebDav</string>
+  <string name="cleartextTrafficPermitted_summary">HTTP connections are not secure. Only enable this if you have other security measures in place.</string>
 
   <string-array name="ChangeLog_1_13">
     <item>Improved password quality estimation by considering most popular passwords.</item>

src/keepass2android-app/Resources/xml/network_security_config.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <network-security-config>
-  <base-config>
+  <base-config cleartextTrafficPermitted="true">
     <trust-anchors>
       <certificates src="system" />
       <certificates src="user" />

src/keepass2android-app/Resources/xml/pref_app_file_handling.xml

@@ -52,6 +52,14 @@
 		android:defaultValue="@bool/PreloadDatabaseEnabled_default"
 		android:title="@string/PreloadDatabaseEnabled_title"
 		android:key="@string/PreloadDatabaseEnabled_key" />
+
+	<CheckBoxPreference
+		android:enabled="true"
+		android:persistent="true"
+		android:summary="@string/cleartextTrafficPermitted_summary"
+		android:defaultValue="false"
+		android:title="@string/cleartextTrafficPermitted_title"
+		android:key="@string/cleartextTrafficPermitted_key" />
 	<CheckBoxPreference
 		android:enabled="true"
 		android:persistent="true"
@@ -80,5 +88,4 @@
 		android:defaultValue="true"
 		android:title="@string/CheckForDuplicateUuids_title"
 		android:key="@string/CheckForDuplicateUuids_key" />
-
 </PreferenceScreen>

src/keepass2android-app/app/App.cs

@@ -847,7 +847,7 @@ public IEnumerable<IFileStorage> FileStorages
 						    new OneDrive2AppFolderFileStorage(),
                             new SftpFileStorage(LocaleManager.LocalizedAppContext, this, IsFtpDebugEnabled()),
 							new NetFtpFileStorage(LocaleManager.LocalizedAppContext, this, IsFtpDebugEnabled),
-							new WebDavFileStorage(this),
+							new WebDavFileStorage(this, App.Context),
 							new PCloudFileStorage(LocaleManager.LocalizedAppContext, this),
                             new PCloudFileStorageAll(LocaleManager.LocalizedAppContext, this),
                             new MegaFileStorage(App.Context),

src/keepass2android-app/settings/AppSettingsActivity.cs

@@ -641,8 +641,6 @@ private void OnUseOfflineCacheChanged(object sender, Preference.PreferenceChange
                     builder.SetCancelable(false);
                     Dialog dialog = builder.Create();
                     dialog.Show();
-
-
                 }
             }
 
@@ -654,7 +652,11 @@ public override void OnCreate(Bundle? savedInstanceState)
                 Preference cachingPreference = FindPreference(GetString(Resource.String.UseOfflineCache_key));
                 cachingPreference.PreferenceChange += OnUseOfflineCacheChanged;
 
-                
+#if EXCLUDE_JAVAFILESTORAGE || NoNet
+                // hide network related preference in NoNet variant:
+                Preference cleartextPreference = FindPreference(GetString(Resource.String.cleartextTrafficPermitted_key));
+                cleartextPreference.Visible = false;
+#endif
 
             }
         }