unsafe implementation of WebView SSL Error Handler

[mohadel92]

Version of the agora_rtc_engine

agora_rtc_engine 6.3.0
with flutter package
agora_uikit

Platforms affected

• Android
• iOS
• macOS
• Windows
• Web

Steps to reproduce

To Reproduce
Steps to reproduce the behavior:

1. use agora package: agora_uikit
2. build your app
3. create your release
4. Submit your release for review

Expected results

App should pass the review of Google Play Console

Actual results

The app is rejected due to issue with " unsafe implementation of WebView SSL Error Handler"

Code sample

No response

Screenshots or Video

Logs

No response

Flutter Doctor output

Doctor summary (to see all details, run flutter doctor -v):
[✓] Flutter (Channel stable, 3.22.3, on macOS 14.4.1 23E224 darwin-x64, locale en-EG)
[✓] Android toolchain - develop for Android devices (Android SDK version 34.0.0)
[✓] Xcode - develop for iOS and macOS (Xcode 15.4)
[✓] Chrome - develop for the web
[✓] Android Studio (version 2023.3)
[✓] VS Code (version 1.92.2)
[✓] Connected device (2 available)

[littleGnAl]

I checked the package name io.agora.online.component.teachaids, and it is not from our package, I think it's better to check the dependencies in your project and see where it comes from, and raise an issue to that package repo.

[mohadel92]

@littleGnAl
this project used to use agora flexible android sdk via flutter
and they removed this integration completely
could it be the reason for such issue?
and how to debug or remove all the sdk remnants ?

[mohadel92]

@littleGnAl
Kindly i need some help regarding this issue
i was asked by agora support team to. use this native code

 override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        
        // If you're adding a WebView, you would do it like this:
       // val webView = WebView(this)
        setContentView(webView) // Make the WebView the content view, or add it to your layout

        webView.webViewClient = object : WebViewClient() {
            override fun onReceivedSslError(view: WebView, handler: SslErrorHandler, error: SslError) {
                handler.cancel() // Cancel the request if there is an SSL error
            }
        }

        webView.loadUrl("https://your-secure-url.com")
    }

will this code be enough to handle such issue ?

[littleGnAl]

I think you should ask the library owner to fix this issue.

[mohadel92]

whom to ask @littleGnAl

[littleGnAl]

Where did you get this package io.agora.online.component.teachaids, you should ask them to fix it.

[github-actions]

Without additional information, we are unfortunately not sure how to resolve this issue. We are therefore reluctantly going to close this bug for now. If you find this problem please file a new issue with the same description, what happens, logs and the output. All system setups can be slightly different so it's always better to open new issues and reference the related ones. Thanks for your contribution.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please raise a new issue.