Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Android] Update OkHttp to 3.14.9 to improve security #30609

Closed
wants to merge 2 commits into from

Conversation

WookieFPV
Copy link

Summary

Okhttp 3.12.X allows Connections using TLS 1.0 and TLS1.1.
TLS 1.0 and TLS 1.1 are no longer secure.
Google, Mozilla, Microsoft, and Apple announced that their browsers will require TLSv1.2 or better starting in early 2020.

https://square.github.io/okhttp/changelog_3x/#version-310
https://github.com/facebook/react-native/wiki/Changelog

Starting from 3.13.0 TLSv1 and TLSv1.1 are no longer enabled by default.
3.13.0 requires JAVA 8 and Android SDK 21 (which was blocking the Upgrade in the Past).

Changelog

[Android] [Changed] - Update Okhttp to version 3.14.19

Test Plan

Current tests should pass.
Connections using TLS 1.0 and TLS 1.1 should not be possible.

@facebook-github-bot facebook-github-bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Dec 17, 2020
@react-native-bot react-native-bot added the Platform: Android Android applications. label Dec 17, 2020
@analysis-bot
Copy link

analysis-bot commented Dec 17, 2020

Platform Engine Arch Size (bytes) Diff
ios - universal n/a --

Base commit: fa406ac

@dulmandakh
Copy link
Contributor

@WookieFPV could you please rebase so that Android CI works as expected.

@analysis-bot
Copy link

Platform Engine Arch Size (bytes) Diff
android hermes arm64-v8a 8,891,051 +6,094
android hermes armeabi-v7a 8,389,463 +6,099
android hermes x86 9,379,435 +6,096
android hermes x86_64 9,324,476 +6,101
android jsc arm64-v8a 10,346,075 +6,092
android jsc armeabi-v7a 9,827,559 +6,081
android jsc x86 10,395,950 +6,092
android jsc x86_64 10,981,244 +6,098

Base commit: fa406ac

@WookieFPV
Copy link
Author

@dulmandakh thank you, the android CI now works as expected.

@dulmandakh
Copy link
Contributor

Please, remember to bump okio as well.

@WookieFPV
Copy link
Author

The latest okio Version 1.X is already used.
Okhttp 3.13.0+ requires okio Version 1.17.3 or later and RN uses 1.17.5 (https://square.github.io/okhttp/changelog_3x/#version-3130).

This should be fine in my optionion.
I don't feel comfortable doing a major upgrade on okio, I mostly do RN and very few native android development.

@dulmandakh
Copy link
Contributor

@fkgozali I would propose merge this PR, because bumping okhttp to 4.x would add Kotlin as a dependency, also some APIs changed thus tests are failing.

Copy link
Contributor

@facebook-github-bot facebook-github-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@fkgozali has imported this pull request. If you are a Facebook employee, you can view this diff on Phabricator.

@facebook-github-bot
Copy link
Contributor

@fkgozali merged this pull request in 6bfd89d.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. Merged This PR has been merged. Platform: Android Android applications.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants