apache / apache/cordova-plugin-file-transfer

images failing from whitelisted urls

Open
#334 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
606
Forks
874
PR merge metrics
No merged PRs in 30d

Description

# Bug Report

## Problem
I get a `401` error when I try to download images using the file-transfer plugin. My server doesn't return a `401` status at all, so it's not an issue with authentication on my server. I tracked down the code that's generating the `401` status to [this line of code](https://github.com/apache/cordova-plugin-file-transfer/blob/ec11d2fd0e87d7d9e0ba94b1989ffb71af1c3c96/src/android/FileTransfer.java#L698) that sends the `401` status if the url is not in the allow list for the app. The problem is that the url should match because its base is in the allow list. I have set the allow list to allow both full and wildcard matching of the base url, yet this problem continues to happen. These are my `access` tags for the base url:
```



```
And an example of an image url that's not getting downloaded is `https://cloud.dev.textras.com/v1/media/round?r=32&q=100&f=images/6151be6d02dbc700142308af/thumbnail.jpeg`. The image loads correctly in an `img` tag and in the browser.

### What is expected to happen?
The image should be downloaded without problems.

### What does actually happen?
Please see the problem description above

## Information

Please see the problem description above

### Command or Code

N/A

### Environment, Platform, Device

From Android 8 to latest Android

### Version information

- Cordova CLI 10
- Cordova Android 10.1.0
- file transfer plugin at [commit `ec11d2fd0e87d7d9e0ba94b1989ffb71af1c3c96`](https://github.com/apache/cordova-plugin-file-transfer/commit/ec11d2fd0e87d7d9e0ba94b1989ffb71af1c3c96)

## Checklist

- [x] I searched for existing GitHub issues
- [x] I updated all Cordova tooling to most recent version
- [x] I included all the necessary information above

Contributor guide

Open the contributing guide

Research direction

Start in src/android/FileTransfer.java at the allow-list check around line 698, then compare the three access patterns with the example cloud.dev.textras.com URL. Reproduce the download on Android using the stated Cordova and plugin versions, and verify that the whitelisted image downloads without the plugin returning 401.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java, javascript
Domain
mobile-dev, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.