[anupamme]

The application downloads an APK from apkUrl and proceeds toward installation without verifying the package's signature or comparing its digest with a trusted expected value. The URL appears to be internally controlled, so exploitation is not established, but compromise of the URL source or download path could result in a malicious package being installed on a connected device. This is defence-in-depth at app/utils/webusb-adb-install.ts:33 rather than a vulnerability I can show is exploitable here — it makes the failure mode explicit and bounded. Close it freely if the pattern is intentional.

Reference: CWE-494

What changed

• app/utils/webusb-adb-install.ts

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

---

Automated security fix by OrbisAI Security

[coderabbitai]

Walkthrough

installApkViaWebUsb now checks the parsed apkUrl protocol before fetching. It throws an error for non-HTTPS URLs. HTTPS URLs continue through the existing installation flow.

Changes

WebUSB APK installation

Layer / File(s)	Summary
Validate APK URL protocol app/utils/webusb-adb-install.ts	The function rejects URLs that do not use HTTPS before fetching. HTTPS URLs continue to the existing fetch flow.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: yibaebi

Merge Risk: Minimal · up to 54749

This change rejects non-HTTPS APK URLs before downloading, which tightens the install path without altering behavior for valid URLs. Full APK integrity verification would need a trusted digest source that does not exist in this flow today, so it is better handled as a separate follow-up. No merge-blocking risk was found.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies a security hardening change in webusb-adb-install.ts and references CWE-494. It is concise and related to the changeset.
Description check		The description explains the APK download risk, identifies the affected file, and relates the proposed defence-in-depth change to CWE-494.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 1 files.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

⚠️ This pull request has been flagged as potential spam (promotional) by CodeRabbit slop detection and should be reviewed carefully.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the URL with care,
Only HTTPS may pass from there.
The APK fetch can then begin,
A careful check before install.
The bunny hops beneath the moon.}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

🔇 Additional comments: 1

app/utils/webusb-adb-install.ts-35-37: 1

35-37: Major · Security & Privacy · Heavy lift

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Verify the APK artifact, not only the transport.

This check only requires the initial URL to use HTTPS. A compromised URL source or HTTPS origin can still return a malicious APK, which this function pushes and installs. Compare the downloaded bytes with a trusted digest or verify the APK signing certificate before sync.write. The current change does not fully address the stated CWE-494 objective.

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d9c2f66c-ad65-4f6f-9844-5712033579eb

Commits

Reviewing files that changed from the base of the PR and between 5e6aa4e and 5474967.

Files selected for processing: 1

• app/utils/webusb-adb-install.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.