Fix #16: SSL pinning in all 4 Flutter apps
- Created ssl_pinning.dart with SHA-256 DER hash pinning for intaleq.xyz and siromove.com - Replaced http.post/http.get with pinned client in all CRUD classes - Added crypto dependency to siro_admin and siro_driver pubspec
This commit is contained in:
41
siro_rider/lib/controller/functions/ssl_pinning.dart
Normal file
41
siro_rider/lib/controller/functions/ssl_pinning.dart
Normal file
@@ -0,0 +1,41 @@
|
||||
import 'dart:convert';
|
||||
import 'dart:io';
|
||||
import 'package:crypto/crypto.dart';
|
||||
import 'package:http/http.dart' as http;
|
||||
|
||||
class SslPinning {
|
||||
SslPinning._();
|
||||
|
||||
static final Map<String, List<String>> _pins = {
|
||||
'intaleq.xyz': [
|
||||
'/tNRUeeLxUhQU5gbgdpVWC6QBGAqc/ujg8Kcf0wQiAM=',
|
||||
'Hlx/0EWNDH5Xkt2KzvqxUzbw0vvEsyZSlibialSyGqI=',
|
||||
],
|
||||
'siromove.com': [
|
||||
'C5+lpZ7tcVwmwQIMcRtPbsQtWLABXhQzejna0wHESsl=',
|
||||
'diGVwiVYbubAI3RW4hB9xU8e/CH2GnkuvVFZE8zmgzI=',
|
||||
],
|
||||
};
|
||||
|
||||
static final List<String> _globalPins = [
|
||||
'Ex/Od4QBaJmloAIDqe/IDxjrvXVYBxftwVU1gJMINuw=',
|
||||
'lrzsBiZJdvN0YHeazyjFp8/oo8Cq4RqP/O4FwL3fCMY=',
|
||||
'aXKbjhWobvwXelevtxcd/GSt0owvyozxUH40RTzLFHA=',
|
||||
];
|
||||
|
||||
static http.Client createPinnedClient() {
|
||||
final httpClient = HttpClient()
|
||||
..badCertificateCallback =
|
||||
(X509Certificate cert, String host, int port) {
|
||||
final derHash = base64.encode(sha256.convert(cert.der).bytes);
|
||||
for (final entry in _pins.entries) {
|
||||
if (host.endsWith(entry.key)) {
|
||||
if (entry.value.contains(derHash)) return true;
|
||||
}
|
||||
}
|
||||
if (_globalPins.contains(derHash)) return true;
|
||||
return false;
|
||||
};
|
||||
return http.IOClient(httpClient);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user