Skip to content

Security and bug fixes - #1

Open
rodri2482 wants to merge 4 commits into
mainfrom
security-and-bug-fixes
Open

rodri2482 wants to merge 4 commits into
mainfrom
security-and-bug-fixes

Conversation

@rodri2482

Copy link
Copy Markdown
Owner

No description provided.

Security:
- Remove unused network/Firebase deps (retrofit, okhttp, moshi, firebase-ai,
  appcheck recaptcha+debug) to cut attack surface
- Enable R8 shrinking for releasable code hiding
- Gitignore upload keystores and keystore properties
- Add SECURITY.md with vulnerability-reporting policy

Bugs:
- Locale-independent formatting (Locale.US) so displays and memory+parsing
  never break on comma-decimal devices (DE, TR, etc.)
- Loan: round total months, reject 0 months (was producing Infinity payment)
- Overflow reports 'Result too large' instead of 'Cannot divide by zero'
- Cap parenthesis nesting at 150 to prevent StackOverflowError crashes
- History capped at 100 entries (was unbounded)
- Settings, theme, memory and DEG/RAD mode now persisted (SharedPreferences)
- Calculation history persisted via Room, survives process death
- Accessibility: CalcButton exposes Role.Button + contentDescription

Infrastructure:
- Unit tests for the expression evaluator (errors, precedence, locale, trig)
- GitHub Actions CI: build + Robolectric unit tests
- README, MIT LICENSE
…ting, namespace rename

- Conventional percent semantics: 10+50% -> 15, 100-50% -> 50;
  plain 50% still divides by 100
- Fix unreachable binary modulo (postfix '%' consumed it first):
  10%3 now evaluates to 1; modulo by zero raises a proper error
- Scientific-notation results (1.5E12) are normalized back into
  1.5*10^12 so they can be reused after '=' (was a Syntax Error)
- BMI unit switch now converts entered height/weight instead of
  reinterpretating the same numbers
- Decimal-places setting (2/4/6/8) exposed in the Settings dialog
  and persisted (decimalPrecision was dead state before)
- Namespace/applicationId renamed com.example ->
  com.rodri2482.calcquick for Play Store publishing
- All 36 parser scenarios validated via faithful JS reimplementation
  (a class-free port of the same algorithm); found+fixed a real bug
  where the peek-only percent check didn't consume '%', leaving it
  re-visible to the modulo branch (50% parsed as a syntax error)
- Fix applied to eatPercentAsPostfix: consume on postfix success
- Add conventional-semantics tests: 200*2+10% -> 440 (Windows/Google
  calculator convention), (2+50)*2-10% -> 93.6
- Sound Feedback toggle now actually plays a short system key tone:
  CompositionLocal(LocalFeedbackSound) provided from uiState.soundEnabled
  in MainActivity; CalcButton plays TONE_PROP_KEY when enabled
…flow)

- CI now generates the debug keystore on the runner and uploads the
  debug-signed APK as a downloadable artifact every build
- New release.yml: workflow_dispatch / v* tag triggered signed release
  build; keystore decoded from RELEASE_KEYSTORE_BASE64 secret, APK
  uploaded as artifact and attached to tag releases
- build.gradle.kts: alias configurable via KEY_ALIAS env (defaults upload)
- README: releasing/deploying section (debug APK, release APK, Play AAB)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant