Details
Description
New rule to implement
Like for the same rule in Java, kotlin analyzer should raise when:
- an incorrect tls version is used as argument of tlsVersions okhttp method call:
val spec: ConnectionSpec = ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS) .tlsVersions(TlsVersion.TLS_1_2) .build()
incorrect versions to support:
TlsVersion.TLS_1_1 TlsVersion.TLS_1_0
- an incorrect tls version is used as argument of sslcontext.getinstance method call:
val sc: SSLContext = SSLContext.getInstance("TLSv1.1") // Noncompliant (s4423)
incorrect versions to support:
SSL SSLv2 SSLv3 TLSv1 TLSv1.1 DTLSv1.0
Covers some parts of this MSTG section: "Verifying Data Encryption on the Network (MSTG-NETWORK-1 and MSTG-NETWORK-2)"
Attachments
Issue Links
- implements
-
RSPEC-4423 Weak SSL/TLS protocols should not be used
- Active
- relates to
-
SONARJAVA-3801 Rule S4423 should support okhttp library
-
- Closed
-