rspec/rules/S5527/kotlin/rule.adoc

To establish a SSL/TLS connection not vulnerable to man-in-the-middle attacks, it's essential to make sure the server presents the right certificate. 

The certificate's hostname-specific data should match the server hostname.


It's not recommended to re-invent the wheel by implementing custom hostname verification.

TLS/SSL libraries provide built-in hostname verification functions that should be used.


This rule raises an issue when:

* HostnameVerifier.verify() method always return true

== Noncompliant Code Example

----
val hostnameVerifier = HostnameVerifier { _, session ->
  true  // Noncompliant
}

val url = URL("https://example.org/")
val urlConnection = url.openConnection() as HttpsURLConnection
urlConnection.hostnameVerifier = hostnameVerifier
----

== Compliant Solution

----
val hostnameVerifier = HostnameVerifier { _, session ->
    HttpsURLConnection.getDefaultHostnameVerifier().run {
        verify("example.com", session)
    }
}

val url = URL("https://example.org/")
val urlConnection = url.openConnection() as HttpsURLConnection
urlConnection.hostnameVerifier = hostnameVerifier
----

include::../see.adoc[]