From 59e01e38fef26b454e07ddde35bd34bf2366e13e Mon Sep 17 00:00:00 2001 From: RinCodeForge927 Date: Tue, 13 Jan 2026 20:59:53 +0700 Subject: [PATCH] refactor: move public api key to build config --- app/build.gradle.kts | 4 ++++ .../java/org/schabi/newpipe/util/potoken/PoTokenWebView.kt | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/app/build.gradle.kts b/app/build.gradle.kts index 1aa5297c5..05be768ac 100644 --- a/app/build.gradle.kts +++ b/app/build.gradle.kts @@ -48,6 +48,10 @@ android { System.getProperty("versionNameSuffix")?.let { versionNameSuffix = it } testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner" + + // Move public API key to BuildConfig to avoid direct exposure in source code + val googleApiKey = System.getenv("NEWPIPE_GOOGLE_API_KEY") ?: "AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw" + buildConfigField("String", "GOOGLE_API_KEY", "\"$googleApiKey\"") } buildTypes { diff --git a/app/src/main/java/org/schabi/newpipe/util/potoken/PoTokenWebView.kt b/app/src/main/java/org/schabi/newpipe/util/potoken/PoTokenWebView.kt index 9b4b500f0..155d4ae7d 100644 --- a/app/src/main/java/org/schabi/newpipe/util/potoken/PoTokenWebView.kt +++ b/app/src/main/java/org/schabi/newpipe/util/potoken/PoTokenWebView.kt @@ -363,8 +363,8 @@ class PoTokenWebView private constructor( companion object : PoTokenGenerator.Factory { private val TAG = PoTokenWebView::class.simpleName - // Public API key used by BotGuard, which has been got by looking at BotGuard requests - private const val GOOGLE_API_KEY = "AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw" // NOSONAR + // Public API key used by BotGuard, moved to BuildConfig + private const val GOOGLE_API_KEY = BuildConfig.GOOGLE_API_KEY private const val REQUEST_KEY = "O43z0dpjhgX20SCx4KAo" private const val USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " + "AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3"