37 lines
1.1 KiB
Plaintext
37 lines
1.1 KiB
Plaintext
|
To establish a SSL/TLS connection not vulnerable to man-in-the-middle attacks, it's essential to make sure the server presents the right certificate.
|
||
|
|
The certificate's hostname-specific data should match the server hostname.
|
||
|
|
|
||
|
|
It's not recommended to re-invent the wheel by implementing custom hostname verification.
|
||
|
|
TLS/SSL libraries provide built-in hostname verification functions that should be used.
|
||
|
|
|
||
|
|
This rule raises an issue when:
|
||
|
|
- HostnameVerifier.verify() method always return true
|
||
|
|
|
||
|
|
== Noncompliant Code Example
|
||
|
|
|
||
|
|
----
|
||
|
|
val hostnameVerifier = HostnameVerifier { _, session ->
|
||
|
|
true // Noncompliant
|
||
|
|
}
|
||
|
|
|
||
|
|
val url = URL("https://example.org/")
|
||
|
|
val urlConnection = url.openConnection() as HttpsURLConnection
|
||
|
|
urlConnection.hostnameVerifier = hostnameVerifier
|
||
|
|
----
|
||
|
|
|
||
|
|
== Compliant Solution
|
||
|
|
|
||
|
|
----
|
||
|
|
val hostnameVerifier = HostnameVerifier { _, session ->
|
||
|
|
HttpsURLConnection.getDefaultHostnameVerifier().run {
|
||
|
|
verify("example.com", session)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
val url = URL("https://example.org/")
|
||
|
|
val urlConnection = url.openConnection() as HttpsURLConnection
|
||
|
|
urlConnection.hostnameVerifier = hostnameVerifier
|
||
|
|
----
|
||
|
|
|
||
|
|
include::../see.adoc[]
|