wangjia
1b091f3be0
新增 ci/scan-cleartext.sh 扫描 client/android AndroidManifest.xml, 防止将来把 usesCleartextTraffic="true" 重新加回(退回明文态)。 CI 新增 cleartext-scan job,并把该脚本纳入 lint job 的 shellcheck 覆盖 (单独挂载 ci/ 目录,不动 scripts/ci 既有挂载)。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u
13 lines
650 B
Bash
Executable File
13 lines
650 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# scan-cleartext.sh — 禁止 Android manifest 重新开启全局明文(控制面已 https/CF Tunnel)。
|
|
# usesCleartextTraffic="true" 会让全 app 允许明文 HTTP,退回 #25 之前的不安全态。
|
|
set -euo pipefail
|
|
|
|
MANIFEST="client/android/app/src/main/AndroidManifest.xml"
|
|
if grep -q 'usesCleartextTraffic="true"' "$MANIFEST"; then
|
|
echo "❌ $MANIFEST 含 usesCleartextTraffic=\"true\":控制面已 https,禁止全局明文。" >&2
|
|
echo " 如个别调试域名确需明文,请用 res/xml/network_security_config.xml 按域白名单,勿开全局。" >&2
|
|
exit 1
|
|
fi
|
|
echo "✅ Android manifest 未开启全局明文"
|