Google Play Security Alert. Your application uses an unsafe implementation of HostnameVerifier

Question

Recently, one of my apps received a security alert on Google Play, as shown below.

The application uses an unsafe implementation of HostnameVerifier . And a link to the Google Play Help Center for details on the fix and the deadline for vulnerability.

Below is my code.

HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier(){ 
    public boolean verify(String arg0, SSLSession arg1) {
        return true;
}}); 

Anyone can explain an example, what changes should be made to correct this warning?

Answer 1

- , APK

HostnameVerifier. . Google, . HostnameVerifier setDefaultHostnameVerifier. - OKHTTP lib http-. , TrustManager .

HostnameVerifier setDefaultHostnameVerifier(), , lib. ​​, ,

HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
    public boolean verify(final String hostname, final SSLSession session) {
        if (/* check if SSL is really valid */)
            return true;
        else
            return false;
    }
});

, .
, webView,

@Override
public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
    // the main thing is to show dialog informing user
    // that SSL cert is invalid and prompt him to continue without 
    // protection: handler.proceed();
    // or cancel: handler.cancel();
    String message;
    switch(error.getPrimaryError()) {
        case SslError.SSL_DATE_INVALID:
            message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
            break;
        case SslError.SSL_EXPIRED:
            message = ResHelper.getString(R.string.ssl_cert_error_expired);
            break;
        case SslError.SSL_IDMISMATCH:
            message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
            break;
        case SslError.SSL_INVALID:
            message = ResHelper.getString(R.string.ssl_cert_error_invalid);
            break;
        case SslError.SSL_NOTYETVALID:
            message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
            break;
        case SslError.SSL_UNTRUSTED:
            message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
            break;
        default:
            message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
    }
    mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
            .title(R.string.ssl_cert_error_title)
            .content(message)
            .positiveText(R.string.continue_button)
            .negativeText(R.string.cancel_button)
            .titleColorRes(R.color.black)
            .positiveColorRes(R.color.main_red)
            .contentColorRes(R.color.comment_grey)
            .backgroundColorRes(R.color.sides_menu_gray)
            .onPositive(new MaterialDialog.SingleButtonCallback() {
                @Override
                public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                    mSSLConnectionDialog.dismiss();
                    handler.proceed();
                }
            })
            .onNegative(new MaterialDialog.SingleButtonCallback() {
                @Override
                public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                    handler.cancel();
                }
            })
            .build();
    mSSLConnectionDialog.show(); 
}

mWebView.setWebViewClient(new WebViewClient() {
... // other corresponding overridden methods
}

, , Google :

APK 158 .

, , HostnameVerifier onReceivedSslError() of mWebView.setWebViewClient. : HostNameVerifier.setDefaultHostnameVerifier() true , ! , , SSL true false. .

Answer 2

HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier(){ 
    public boolean verify(String arg0, SSLSession arg1) {
        return true;
}}); 

HTTPS . .

, " ".

Answer 3

, . , . , . Fabric.com,

HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
    @Override
    public boolean verify(String hostname, SSLSession arg1) {
        if (hostname.equalsIgnoreCase("api.my.com") || 
            hostname.equalsIgnoreCase("api.crashlytics.com") || 
            hostname.equalsIgnoreCase("settings.crashlytics.com")) {
            return true;
        } else {
            return false;
        }
    }
});

Answer 4

HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier()
    {
        @Override
        public boolean verify(String hostname,SSLSession arg1)
        {
            if (! hostname.equalsIgnoreCase("www.asdasdad.com"))
                return true;
            else
                return false;
        }
    });

Answer 5

google play console → apk → . apk , ​​ , .