tree 6e0509d81ec004f816619d3a5ce5b767deb32aa4
parent 1cbd67d91edfcedbfd28aac75c1c616ced66ab4a
author Alex Klyubin <klyubin@google.com> 1427471403 -0700
committer Alex Klyubin <klyubin@google.com> 1427478030 -0700

Honor NetworkSecurityPolicy regarding cleartext traffic.

This makes HttpClient instances honor the process-wide policy about
cleartext network traffic. If cleartext network traffic is not
permitted, then attempts to send a cleartext HTTP request will throw
an IOException.

This change is needed despite platform-provided HttpClient being
deprecated because a large fraction of applications still use this
HttpClient library to generate HTTP traffic instead of using
URLConnection.

HttpClient is modular -- most of its parts can be replaced with
alternative implementations. Thus, this CL enforces the cleartext
traffic policy in DefaultRequestDirector because RequestDirector is
least commonly replaced (if ever) and there are no other
RequestDirector implementations provided by the library.

The cleartext policy is enforced pretty late in the process of
emitting a request to give time for any HttpRequestInterceptor
instances to see the request. This is because some apps use a
HttpRequestInterceptor to enforce their own policies about cleartext
HTTP such as catching accidental use of cleartext HTTP and reporting
it to their servers for analysis.

Bug: 19215516
Change-Id: I03687123080475581e7196d9bb8c0d006502d056