Repository: flutter
Issue: Flutter doesn't respect Android's `android:usesCleartextTraffic="false"` settings
Labels: platform-android,engine,dependency: dart,has reproducible steps,P2,dependency: dart:io,found in release: 3.0,found in release: 3.1,team-android,triaged-android

## Steps to Reproduce

1. disable clear text for both `release` and `debug` builds
    * **release:** `android/app/src/main/AndroidManifest.xml` add `android:usesCleartextTraffic="false"` to `<application>` element's attributes
    * **debug:** `android/app/src/debug/AndroidManifest.xml` add `<application android:usesCleartextTraffic="false" />` element for the `<manifest>` element
2. make some `http` request
3. no error is raised no matter if I build against `debug` or `release` mode

## Related Pull Requests

* `android:usesCleartextTraffic="false"` should be respected since flutter/engine/pull/20218
   https://github.com/flutter/engine/commit/dd2c5a1b8bb4fbd76b6882d2daa00a6dc26c14ca#diff-461938e51a0b15219735ea1fdca7abc739f390536deb8239a3598483fa577438R145-R149
* flutter/engine#25299 removed this feature somewhy
   https://github.com/flutter/engine/commit/f0476334b3227f24efcf7636a3ac6086a1576d8c#diff-2777e9e1be51ba3b8b43d3e74741a668427e4eb3967ed759772a9dbe81880605L240-L242
   I think on iOS the result is the same which also ignores the config according to these changes:
   ```dart
   settings.may_insecurely_connect_to_all_domains = true;
   settings.domain_network_policy = "";
   ```
* flutter/engine#25940 fully removed unused Java variables
   https://github.com/flutter/engine/pull/25940/files#diff-461938e51a0b15219735ea1fdca7abc739f390536deb8239a3598483fa577438L147-L165

   > inside `ApplicationInfoLoader.java` which results in calling the underlying xml parsing via the NetworkSecurityPolicy. This results in additional I/O contention in the main thread.

   According to doc: https://developer.android.com/guide/topics/manifest/application-element#usesCleartextTraffic it can also obtained by [ApplicationInfo.flags](https://developer.android.com/reference/android/content/pm/ApplicationInfo#flags) but this may not respect [Network security configuration](https://developer.android.com/training/articles/security-config) file.

## Code sample

**android/app/src/main/AndroidManifest.xml**
```xml
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.disable_clear_text">
   <uses-permission android:name="android.permission.INTERNET"/> <!--Make sure Internet is avaible for release builds-->

  <!--Add android:usesCleartextTraffic="false"-->
   <application
        android:label="disable_clear_text"
        android:name="${applicationName}"
        android:usesCleartextTraffic="false"
        android:icon="@mipmap/ic_launcher">
```

**android/app/src/main/AndroidManifest.xml**
```xml
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.disable_clear_text">
    <uses-permission android:name="android.permission.INTERNET"/>
    <application android:usesCleartextTraffic="false" /> <!--Add this line and make sure it is set to false-->
</manifest>
```

```dart
import 'dart:convert';
import 'dart:io';

import 'package:flutter/material.dart';

void main() {
  runApp(const MyApp());
}

class MyApp extends StatelessWidget {
  const MyApp({Key? key}) : super(key: key);

  @override
  Widget build(BuildContext context) {
    return MaterialApp(
      title: 'Flutter Disable Clear Text',
      theme: ThemeData(
        primarySwatch: Colors.blue,
      ),
      home: const MyHomePage(),
    );
  }
}

class MyHomePage extends StatefulWidget {
  const MyHomePage({super.key});

  @override
  State<MyHomePage> createState() => _MyHomePageState();
}

class _MyHomePageState extends State<MyHomePage> {
  final client = HttpClient();
  var _httpResult = 'Press "Fetch button"';

  void _fetchClearText() async {
    try {
      final url = Uri.parse('http://example.com');
      final request = await client.getUrl(url);
      final response = await request.close();
      final responseData = await response.transform(utf8.decoder).join();

      _httpResult = 'type: ${response.runtimeType}\ncontentLength: ${response.contentLength}\ncontainsHtmlTag: ${responseData.contains('<html>')}';
    } catch (e) {
      _httpResult = e.toString();
    }

    setState(() {});
  }

  @override
  void dispose() {
    client.close();
    super.dispose();
  }

  @override
  Widget build(BuildContext context) {
    return SafeArea(
      child: Scaffold(
        body: Center(
          child: Column(
            mainAxisAlignment: MainAxisAlignment.spaceBetween,
            children: [
              Text(_httpResult),
              ElevatedButton(
                onPressed: _fetchClearText,
                child: const Text('Fetch'),
              ),
            ],
          ),
        ),
      ),
    );
  }
}
```

Optionally override `MainActivity.java` 's consturctor just to make sure whether clear text traffic is permitted (search for `isCleartextTrafficPermitted` inside logcat which should yield: `com.example.disable_clear_text.MainActivity: isCleartextTrafficPermitted: false`)
```java
package com.example.disable_clear_text;

import android.os.Build;
import android.security.NetworkSecurityPolicy;
import android.util.Log;

import io.flutter.embedding.android.FlutterActivity;

public class MainActivity extends FlutterActivity {
    public MainActivity() {
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
            boolean isCleartextTrafficPermitted = NetworkSecurityPolicy.getInstance().isCleartextTrafficPermitted();
            Log.w(MainActivity.class.toString(), "isCleartextTrafficPermitted: " + isCleartextTrafficPermitted);
        }
    }
}
```

[Here is the minimal repository](https://github.com/maRci002/disable_clear_text) to reproduce this issue and [here is the specific commit which contains the above code snippets](https://github.com/maRci002/disable_clear_text/commit/fcb8eeeb3e7b15532b18765822cfa7e8c87de17c).

<details>
  <summary>flutter doctor -v</summary>

```
PS C:\Users\maRci002> flutter doctor -v
[√] Flutter (Channel stable, 3.0.3, on Microsoft Windows [Version 10.0.19044.1766], locale hu-HU)
    • Flutter version 3.0.3 at C:\flutter
    • Upstream repository https://github.com/flutter/flutter.git
    • Framework revision 676cefaaff (5 days ago), 2022-06-22 11:34:49 -0700
    • Engine revision ffe7b86a1e
    • Dart version 2.17.5
    • DevTools version 2.12.2

[√] Android toolchain - develop for Android devices (Android SDK version 32.1.0-rc1)
    • Android SDK at C:\Users\maRci002\AppData\Local\Android\sdk
    • Platform android-32, build-tools 32.1.0-rc1
    • Java binary at: C:\Program Files\Android\Android Studio\jre\bin\java
    • Java version OpenJDK Runtime Environment (build 11.0.12+7-b1504.28-7817840)
    • All Android licenses accepted.

[√] Chrome - develop for the web
    • Chrome at C:\Program Files\Google\Chrome\Application\chrome.exe

[X] Visual Studio - develop for Windows
    X Visual Studio not installed; this is necessary for Windows development.
      Download at https://visualstudio.microsoft.com/downloads/.
      Please install the "Desktop development with C++" workload, including all of its default components

[√] Android Studio (version 2021.2)
    • Android Studio at C:\Program Files\Android\Android Studio
    • Flutter plugin can be installed from:
       https://plugins.jetbrains.com/plugin/9212-flutter
    • Dart plugin can be installed from:
       https://plugins.jetbrains.com/plugin/6351-dart
    • Java version OpenJDK Runtime Environment (build 11.0.12+7-b1504.28-7817840)

[√] VS Code (version 1.68.1)
    • VS Code at C:\Users\maRci002\AppData\Local\Programs\Microsoft VS Code
    • Flutter extension version 3.42.0

[√] Connected device (4 available)
    • sdk gphone64 x86 64 (mobile) • emulator-5554 • android-x64    • Android 12 (API 31) (emulator)
    • Windows (desktop)            • windows       • windows-x64    • Microsoft Windows [Version 10.0.19044.1766]
    • Chrome (web)                 • chrome        • web-javascript • Google Chrome 102.0.5005.115
    • Edge (web)                   • edge          • web-javascript • Microsoft Edge 103.0.1264.37

[√] HTTP Host Availability
    • All required HTTP hosts are available
```

</details>