apache / apache/cordova-plugin-file-transfer
images failing from whitelisted urls
- Dominant language
- JavaScript
- Stars
- 606
- Forks
- 874
- PR merge metrics
- No merged PRs in 30d
Description
# Bug Report
## Problem
I get a `401` error when I try to download images using the file-transfer plugin. My server doesn't return a `401` status at all, so it's not an issue with authentication on my server. I tracked down the code that's generating the `401` status to [this line of code](https://github.com/apache/cordova-plugin-file-transfer/blob/ec11d2fd0e87d7d9e0ba94b1989ffb71af1c3c96/src/android/FileTransfer.java#L698) that sends the `401` status if the url is not in the allow list for the app. The problem is that the url should match because its base is in the allow list. I have set the allow list to allow both full and wildcard matching of the base url, yet this problem continues to happen. These are my `access` tags for the base url:
```
```
And an example of an image url that's not getting downloaded is `https://cloud.dev.textras.com/v1/media/round?r=32&q=100&f=images/6151be6d02dbc700142308af/thumbnail.jpeg`. The image loads correctly in an `img` tag and in the browser.
### What is expected to happen?
The image should be downloaded without problems.
### What does actually happen?
Please see the problem description above
## Information
Please see the problem description above
### Command or Code
N/A
### Environment, Platform, Device
From Android 8 to latest Android
### Version information
- Cordova CLI 10
- Cordova Android 10.1.0
- file transfer plugin at [commit `ec11d2fd0e87d7d9e0ba94b1989ffb71af1c3c96`](https://github.com/apache/cordova-plugin-file-transfer/commit/ec11d2fd0e87d7d9e0ba94b1989ffb71af1c3c96)
## Checklist
- [x] I searched for existing GitHub issues
- [x] I updated all Cordova tooling to most recent version
- [x] I included all the necessary information above
Contributor guide
Research direction
Start in src/android/FileTransfer.java at the allow-list check around line 698, then compare the three access patterns with the example cloud.dev.textras.com URL. Reproduce the download on Android using the stated Cordova and plugin versions, and verify that the whitelisted image downloads without the plugin returning 401.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, java, javascript
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100