chromium/components/cronet/android/test/res/xml/network_security_config.xml

<?xml version="1.0" encoding="utf-8"?>

<!--
Copyright 2016 The Chromium Authors
Use of this source code is governed by a BSD-style license that can be
found in the LICENSE file.
-->

<network-security-config>
  <base-config>
    <trust-anchors>
      <certificates src="@raw/quicroot"/>
      <certificates src="system"/>
    </trust-anchors>
  </base-config>
  <!-- Since Android N (API 24?) it is possible to disable cleartext support.

       This is required to test that we are correctly handling this feature.
  -->
  <domain-config cleartextTrafficPermitted="false">
    <!-- Used by CronetUrlRequestTest#testCleartextTrafficBlocked -->
    <domain includeSubdomains="true">example.com</domain>
  </domain-config>

  <!-- Since Android 9 (API 28) cleartext support is disabled by default, this
       causes some of our tests to fail (see crbug/1220357).
       The following configs allow http requests for the domains used in these
       tests.

       TODO(stefanoduo): Figure out if we really need to use http for these tests
  -->
  <domain-config cleartextTrafficPermitted="true">
    <!-- Used as the base URL by native test server (net::EmbeddedTestServer) -->
    <domain includeSubdomains="true">127.0.0.1</domain>
    <!-- Used by CronetHttpURLConnectionTest#testIOExceptionInterruptRethrown -->
    <domain includeSubdomains="true">localhost</domain>
    <!-- Used by CronetHttpURLConnectionTest#testBadIP -->
    <domain includeSubdomains="true">0.0.0.0</domain>
    <!-- Used by CronetHttpURLConnectionTest#testSetUseCachesFalse -->
    <domain includeSubdomains="true">host-cache-test-host</domain>
    <!-- Used by CronetHttpURLConnectionTest#testBadHostname -->
    <domain includeSubdomains="true">this-weird-host-name-does-not-exist</domain>
    <!-- Used by CronetUrlRequestContextTest#testHostResolverRules -->
    <domain includeSubdomains="true">some-weird-hostname</domain>
  </domain-config>
</network-security-config>