datatheorem / datatheorem/TrustKit-Android
React native SSL pinning works but PinningFailureReportBroadcastReceiver is not fired/called
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 604
- Forks
- 90
- Avg merge
- 1h 29m
- Merged PRs (30d)
- 2
Description
Describe the bug
On React native after adding the network_security_config the requests are blocked when the PIN doesn't match which is fine but we are not able to get the broadcast of the PIN failure for reporting it to Crashlytics etc.
To Reproduce
Launch the app.
Connect to the service.
Network error is received and the API call fails.
No broadcast happens.
Expected behavior
The broadcast should be fired.
TrustKit configuration
implementation 'com.datatheorem.android.trustkit:trustkit:1.1.3'
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config cleartextTrafficPermitted="false">
<domain includeSubdomains="true">xxxx.xxx-xxx-xxx.com</domain>
<pin-set>
<pin digest="SHA-256">fdsgfdw343wtrbvdfbggdfgd54545345353=</pin>
<pin digest="SHA-256">fdsgfdw343wtrbvdfbggdfgd54545345353=</pin>
</pin-set>
<trustkit-config enforcePinning="true"></trustkit-config>
</domain-config>
<domain-config cleartextTrafficPermitted="false">
<domain includeSubdomains="true">xxx-xxxx-xxx.xxx.xxxxx</domain>
<pin-set>
<pin digest="SHA-256">fdsgfdw343wtrbvdfbggdfgd54545345353==</pin>
<pin digest="SHA-256">fdsgfdw343wtrbvdfbggdfgd54545345353==</pin>
</pin-set>
<trustkit-config enforcePinning="false"></trustkit-config>
</domain-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">10.0.2.2</domain>
<domain includeSubdomains="true">localhost</domain>
</domain-config>
</network-security-config>
App details:
- App target SDK: 29
- App language: React native, Android, Axios
- Android version to reproduce the bug: Android 29 Emulator
Additional context
MainActivity.java
private static final PinningFailureReportBroadcastReceiver pinningFailureReportBroadcastReceiver
= new PinningFailureReportBroadcastReceiver();
@Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
TrustKit.initializeWithNetworkSecurityConfiguration(this);
LocalBroadcastManager.getInstance(this)
.registerReceiver(pinningFailureReportBroadcastReceiver, new IntentFilter(BackgroundReporter.REPORT_VALIDATION_EVENT));
@Override
protected void onDestroy() {
LocalBroadcastManager.getInstance(getApplicationContext())
.unregisterReceiver(pinningFailureReportBroadcastReceiver);
super.onDestroy();
}
And within MainActivity.java
static class PinningFailureReportBroadcastReceiver extends BroadcastReceiver {
@Override
public void onReceive(Context context, Intent intent) {
PinningFailureReport report = (PinningFailureReport) intent.getSerializableExtra(BackgroundReporter.EXTRA_REPORT);
Log.v(TAG, "Received PinningFailureReport " + report.toString());
}
}
At this point, I am not sure whether TrustKit is doing the PIN rejection of is it the OS doing it by default.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with MainActivity.java and reproduce the failure on the Android 29 emulator using the provided network-security-config and TrustKit initialization. Trace whether the rejected connection reaches TrustKit reporting or is rejected by the OS, then verify that PinningFailureReportBroadcastReceiver receives the expected report through the registered LocalBroadcastManager receiver.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, java, react-native
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100