How to security patch the Android Gradle Plugin

README.md

How to security patch the Android Gradle Plugin

Its got two main areas, the plugin itself in the buildscript and its UTP (Unified Test Platform) in the configurations, they share some similar dependencies but not idential and because of this some patching might get missed at a component level.

See the build.gradle.kts for code examples.

For a long time I couldn't understand where the extra dependencies kept coming from, including duplicates of the same library but at different versions, for more details ramblings, and where I initially wrote up my findings go read this beercanx/retro-brick-game-raylib#30 (comment)

Testing

You should always test and check things, especially after manual security patching as new versions may remove the need for the ducktape patching.

For the plugin you can check what libraries are what version via

./gradlew buildEnvironment | grep 'httpclient'
|         |    |    |    \--- org.apache.httpcomponents:httpclient:4.5.12 -> 4.5.14
|         |    +--- org.apache.httpcomponents:httpclient:4.5.14 (*)

For project depenencies, or custom scopes such as used by UTP, these can be checked via

./gradlew dependencies | grep 'httpclient'
     |    |    |    \--- org.apache.httpcomponents:httpclient:4.5.12

build.gradle.kts

plugins {
    id("com.android.application") version "9.2.0"
}

repositories {
    google()
    mavenCentral()
}

buildscript {

    // Review these on each update of the AGP (com.android.application)
    gradle.extra["securityBoms"] = listOf(
        "org.bouncycastle:bc-jdk18on-bom:1.84", // 1.79 has vulnerabilities
        "io.netty:netty-bom:4.1.132.Final", // 4.1.130.Final has vulnerabilities
    )
    gradle.extra["securityPatches"] = listOf(
        "org.apache.httpcomponents:httpclient:4.5.14", // 4.5.12 has vulnerabilities
        // ..etc
    )

    // Handles the patching of the Android Gradle Plugin
    dependencies {
        for (securityBom in gradle.extra["securityBoms"] as List<*>) {
            classpath(platform(securityBom!!))
        }
        constraints {
            for (securityPatch in gradle.extra["securityPatches"] as List<*>) {
                classpath(securityPatch!!)
            }
        }
    }
}

// Handles the patching of the Android UTP (Unified Test Platform) and Android Lint
configurations.named { it.startsWith("unified-test-platform") || it == "androidLintTool" }.configureEach {
    dependencies {
        for (securityBom in gradle.extra["securityBoms"] as List<*>) {
            add(name, platform(securityBom!!))
        }
        constraints {
            for (securityPatch in gradle.extra["securityPatches"] as List<*>) {
                add(name, securityPatch!!)
            }
        }
    }
}

java {
    toolchain {
        // ..etc
    }
}

android {
    // ..etc
}