Skip to content

Commit a98528e

Browse files
cortinicofacebook-github-bot
authored andcommitted
Make the addition of JitPack repository configurable (#48595)
Summary: Pull Request resolved: #48595 Historically React Native used to include the JitPack repository be default in the default repositories. This sadly exposes React Native projects to supply chain attacks as explained here: https://blog.oversecured.com/Introducing-MavenGate-a-supply-chain-attack-method-for-Java-and-Android-applications/ Moreover, artifacts on Jitpack are not GPG signed it's complicated to verify the identity of artifact authors. I'm introducing a Gradle property to control if Jitpack should be included by default or not. User can control this behavior by changing their `gradle.properties` file as such: ``` includeJitpackRepository=false ``` The default value of this property is currently true, but we're looking into changing it to false in the future. Changelog: [Android] [Added] - Make the addition of JitPack repository configurable Reviewed By: cipolleschi Differential Revision: D68016028 fbshipit-source-id: 392513fef389a4835b4e00a8184459e00d51fdd0
1 parent c85be01 commit a98528e

File tree

3 files changed

+102
-6
lines changed

3 files changed

+102
-6
lines changed

packages/gradle-plugin/react-native-gradle-plugin/src/main/kotlin/com/facebook/react/utils/DependencyUtils.kt

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,13 @@
88
package com.facebook.react.utils
99

1010
import com.facebook.react.utils.PropertyUtils.DEFAULT_INTERNAL_PUBLISHING_GROUP
11+
import com.facebook.react.utils.PropertyUtils.INCLUDE_JITPACK_REPOSITORY
12+
import com.facebook.react.utils.PropertyUtils.INCLUDE_JITPACK_REPOSITORY_DEFAULT
1113
import com.facebook.react.utils.PropertyUtils.INTERNAL_PUBLISHING_GROUP
1214
import com.facebook.react.utils.PropertyUtils.INTERNAL_REACT_NATIVE_MAVEN_LOCAL_REPO
1315
import com.facebook.react.utils.PropertyUtils.INTERNAL_USE_HERMES_NIGHTLY
1416
import com.facebook.react.utils.PropertyUtils.INTERNAL_VERSION_NAME
17+
import com.facebook.react.utils.PropertyUtils.SCOPED_INCLUDE_JITPACK_REPOSITORY
1518
import java.io.File
1619
import java.net.URI
1720
import java.util.*
@@ -55,12 +58,14 @@ internal object DependencyUtils {
5558
it.excludeGroup("com.facebook.react")
5659
}
5760
}
58-
mavenRepoFromUrl("https://www.jitpack.io") { repo ->
59-
repo.content {
60-
// We don't want to fetch JSC or React from JitPack
61-
it.excludeGroup("org.webkit")
62-
it.excludeGroup("io.github.react-native-community")
63-
it.excludeGroup("com.facebook.react")
61+
if (shouldAddJitPack()) {
62+
mavenRepoFromUrl("https://www.jitpack.io") { repo ->
63+
repo.content { content ->
64+
// We don't want to fetch JSC or React from JitPack
65+
content.excludeGroup("org.webkit")
66+
content.excludeGroup("io.github.react-native-community")
67+
content.excludeGroup("com.facebook.react")
68+
}
6469
}
6570
}
6671
}
@@ -167,4 +172,13 @@ internal object DependencyUtils {
167172
it.url = uri
168173
action(it)
169174
}
175+
176+
internal fun Project.shouldAddJitPack() =
177+
when {
178+
hasProperty(SCOPED_INCLUDE_JITPACK_REPOSITORY) ->
179+
property(SCOPED_INCLUDE_JITPACK_REPOSITORY).toString().toBoolean()
180+
hasProperty(INCLUDE_JITPACK_REPOSITORY) ->
181+
property(INCLUDE_JITPACK_REPOSITORY).toString().toBoolean()
182+
else -> INCLUDE_JITPACK_REPOSITORY_DEFAULT
183+
}
170184
}

packages/gradle-plugin/react-native-gradle-plugin/src/main/kotlin/com/facebook/react/utils/PropertyUtils.kt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,13 @@ object PropertyUtils {
2222
const val REACT_NATIVE_ARCHITECTURES = "reactNativeArchitectures"
2323
const val SCOPED_REACT_NATIVE_ARCHITECTURES = "react.nativeArchitectures"
2424

25+
/** Public property that allows to control whether the JitPack repository is included or not */
26+
const val INCLUDE_JITPACK_REPOSITORY = "includeJitpackRepository"
27+
const val SCOPED_INCLUDE_JITPACK_REPOSITORY = "react.includeJitpackRepository"
28+
29+
/** By default we include JitPack till React Native 0.80 where this is going to become false */
30+
internal const val INCLUDE_JITPACK_REPOSITORY_DEFAULT = true
31+
2532
/**
2633
* Internal Property that acts as a killswitch to configure the JDK version and align it for app
2734
* and all the libraries.

packages/gradle-plugin/react-native-gradle-plugin/src/test/kotlin/com/facebook/react/utils/DependencyUtilsTest.kt

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import com.facebook.react.utils.DependencyUtils.getDependencySubstitutions
1414
import com.facebook.react.utils.DependencyUtils.mavenRepoFromURI
1515
import com.facebook.react.utils.DependencyUtils.mavenRepoFromUrl
1616
import com.facebook.react.utils.DependencyUtils.readVersionAndGroupStrings
17+
import com.facebook.react.utils.DependencyUtils.shouldAddJitPack
1718
import java.net.URI
1819
import org.assertj.core.api.Assertions.assertThat
1920
import org.gradle.api.artifacts.repositories.MavenArtifactRepository
@@ -98,6 +99,60 @@ class DependencyUtilsTest {
9899
.isNotNull()
99100
}
100101

102+
@Test
103+
fun configureRepositories_withIncludeJitpackRepositoryFalse_doesNotContainJitPack() {
104+
val repositoryURI = URI.create("https://www.jitpack.io")
105+
var project = createProject()
106+
project.extensions.extraProperties.set("includeJitpackRepository", "false")
107+
108+
configureRepositories(project, tempFolder.root)
109+
110+
assertThat(
111+
project.repositories.firstOrNull {
112+
it is MavenArtifactRepository && it.url == repositoryURI
113+
})
114+
.isNull()
115+
116+
// We test both with scoped and unscoped property
117+
project = createProject()
118+
project.extensions.extraProperties.set("react.includeJitpackRepository", "false")
119+
120+
configureRepositories(project, tempFolder.root)
121+
122+
assertThat(
123+
project.repositories.firstOrNull {
124+
it is MavenArtifactRepository && it.url == repositoryURI
125+
})
126+
.isNull()
127+
}
128+
129+
@Test
130+
fun configureRepositories_withincludeJitpackRepositoryTrue_containJitPack() {
131+
val repositoryURI = URI.create("https://www.jitpack.io")
132+
var project = createProject()
133+
project.extensions.extraProperties.set("includeJitpackRepository", "true")
134+
135+
configureRepositories(project, tempFolder.root)
136+
137+
assertThat(
138+
project.repositories.firstOrNull {
139+
it is MavenArtifactRepository && it.url == repositoryURI
140+
})
141+
.isNotNull()
142+
143+
// We test both with scoped and unscoped property
144+
project = createProject()
145+
project.extensions.extraProperties.set("react.includeJitpackRepository", "true")
146+
147+
configureRepositories(project, tempFolder.root)
148+
149+
assertThat(
150+
project.repositories.firstOrNull {
151+
it is MavenArtifactRepository && it.url == repositoryURI
152+
})
153+
.isNotNull()
154+
}
155+
101156
@Test
102157
fun configureRepositories_withProjectPropertySet_hasHigherPriorityThanMavenCentral() {
103158
val localMaven = tempFolder.newFolder("m2")
@@ -404,4 +459,24 @@ class DependencyUtilsTest {
404459

405460
assertThat(mavenRepo.url).isEqualTo(repoFolder.toURI())
406461
}
462+
463+
@Test
464+
fun shouldAddJitPack_withScopedProperty() {
465+
val project = createProject(tempFolder.root)
466+
project.extensions.extraProperties.set("react.includeJitpackRepository", "false")
467+
assertThat(project.shouldAddJitPack()).isFalse()
468+
}
469+
470+
@Test
471+
fun shouldAddJitPack_withUnscopedProperty() {
472+
val project = createProject(tempFolder.root)
473+
project.extensions.extraProperties.set("react.includeJitpackRepository", "false")
474+
assertThat(project.shouldAddJitPack()).isFalse()
475+
}
476+
477+
@Test
478+
fun shouldAddJitPack_defaultIsTrue() {
479+
val project = createProject(tempFolder.root)
480+
assertThat(project.shouldAddJitPack()).isTrue()
481+
}
407482
}

0 commit comments

Comments
 (0)