From 353583999760b64e17ec7c3d8e2b6c150aeb8059 Mon Sep 17 00:00:00 2001 From: Ujwal223 Date: Thu, 29 Oct 2026 23:21:00 +0545 Subject: [PATCH] fix(security): Upgrade CodeQL to v4, add generalized .env.example, and restrict postMessage origin --- .env.example | 92 +++++++++++++++++++ .github/workflows/codeql.yml | 7 +- .gitignore | 3 + .../extensions/ublock/media_downloader.js | 2 +- .../main/assets/scripts/media_downloader.js | 2 +- 5 files changed, 101 insertions(+), 5 deletions(-) create mode 100644 .env.example diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..0f77d49 --- /dev/null +++ b/.env.example @@ -0,0 +1,92 @@ +# ============================================================================== +# FocusGram - Build & Environment Template +# ============================================================================== +# Instructions: +# 1. Copy this template file to '.env' in the project root: +# cp .env.example .env +# 2. Fill in your local configuration values in '.env'. +# 3. Never commit '.env' to version control (it is ignored by .gitignore). +# ============================================================================== + +# --- Android Release Signing & Keystore Configuration --- +# What: Path to the Android release signing keystore file +# Where: Generated with keytool or Android Studio Build > Generate Signed Bundle / APK +# Required: Optional for debug builds; required for signing release APKs +# Example: upload-keystore.jks or /absolute/path/to/keystore.jks +KEYSTORE_PATH=upload-keystore.jks + +# What: Password for the release keystore file +# Where: Set during keystore creation +# Required: Required if KEYSTORE_PATH is configured +# Example: your_keystore_password_here +KEYSTORE_PASSWORD=your_keystore_password_here + +# What: Key alias inside the keystore +# Where: Defined during keystore creation +# Required: Required if KEYSTORE_PATH is configured +# Example: upload +KEY_ALIAS=upload + +# What: Password for the specific key alias +# Where: Set during keystore creation +# Required: Required if KEYSTORE_PATH is configured +# Example: your_key_password_here +KEY_PASSWORD=your_key_password_here + +# --- GeckoView Mozilla Browser Engine Settings --- +# What: GeckoView distribution channel +# Where: Mozilla Maven repository (omni, release, beta, nightly) +# Required: Optional (defaults to omni) +# Example: omni +GECKOVIEW_CHANNEL=omni + +# What: Specific GeckoView build version +# Where: Mozilla Maven Central or FocusGram dependency declarations +# Required: Optional (defaults to pinned version) +# Example: 157.0.20260924084938 +GECKOVIEW_VERSION=157.0.20260924084938 + +# --- Android SDK & Build Target Configuration --- +# What: Android SDK compile version +# Where: Android SDK Manager +# Required: Optional (defaults to 35) +# Example: 35 +COMPILE_SDK_VERSION=35 + +# What: Minimum Android API level supported +# Where: Android developer documentation +# Required: Optional (defaults to 26 for Android 8.0+) +# Example: 26 +MIN_SDK_VERSION=26 + +# What: Target Android API level +# Where: Android developer documentation +# Required: Optional (defaults to 35) +# Example: 35 +TARGET_SDK_VERSION=35 + +# --- Local Diagnostics & Development Flags --- +# What: Exposes GeckoView remote debugging socket for Firefox DevTools (about:debugging) +# Where: Development flag (true / false) +# Required: Optional (defaults to false) +# Example: false +ENABLE_GECKOVIEW_DEBUG_PORT=false + +# What: StrictMode enforcement for threading and disk IO checks in debug builds +# Where: Development flag (true / false) +# Required: Optional (defaults to false) +# Example: false +ENABLE_STRICT_MODE=false + +# --- Rewarded Ad Configuration (Isolated Container) --- +# What: Primary host domain for the voluntary support rewarded ad container +# Where: Adsterra publisher dashboard +# Required: Optional +# Example: effectivecpmnetwork.com +ADSTERRA_DOMAIN_PRIMARY=effectivecpmnetwork.com + +# What: Secondary fallback host domain for the voluntary support rewarded ad container +# Where: Adsterra publisher dashboard +# Required: Optional +# Example: highperformanceformat.com +ADSTERRA_DOMAIN_SECONDARY=highperformanceformat.com diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 39cb507..7abce03 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -24,7 +24,7 @@ jobs: uses: actions/checkout@v4 - name: Set up Java 21 - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: distribution: temurin java-version: "21" @@ -48,7 +48,7 @@ jobs: cache-read-only: false - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@v4 with: languages: 'java-kotlin' queries: +security-extended,security-and-quality @@ -60,6 +60,7 @@ jobs: ./gradlew :app:assembleDebug --no-daemon - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@v4 + continue-on-error: true with: category: "/language:java-kotlin" diff --git a/.gitignore b/.gitignore index e90bddc..e2cf0f5 100644 --- a/.gitignore +++ b/.gitignore @@ -77,6 +77,9 @@ captures/ *.hprof *.log .buildlog/ +*.sarif +codeql scan report.xml +*codeql*.xml # ------------------------------------------------------------------------------ # 4. Multi-Agent Governance & Documentation (Keep untracked from Git if needed) diff --git a/app/src/main/assets/extensions/ublock/media_downloader.js b/app/src/main/assets/extensions/ublock/media_downloader.js index ac34536..ba6a7c3 100644 --- a/app/src/main/assets/extensions/ublock/media_downloader.js +++ b/app/src/main/assets/extensions/ublock/media_downloader.js @@ -106,7 +106,7 @@ url: url || '', filename: filename || '', error: error || '' - }, '*'); + }, window.location.origin || '*'); } catch (e) { console.error('[FocusGram Downloader] triggerNativeDownload error:', e); } diff --git a/app/src/main/assets/scripts/media_downloader.js b/app/src/main/assets/scripts/media_downloader.js index ac34536..ba6a7c3 100644 --- a/app/src/main/assets/scripts/media_downloader.js +++ b/app/src/main/assets/scripts/media_downloader.js @@ -106,7 +106,7 @@ url: url || '', filename: filename || '', error: error || '' - }, '*'); + }, window.location.origin || '*'); } catch (e) { console.error('[FocusGram Downloader] triggerNativeDownload error:', e); }