Details
Major Description
New rule to implement
Like for the same rule in Java, should raise when verify implementation from the HostnameVerifier interface always return true:
builder.hostnameVerifier(object : HostnameVerifier {
override fun verify(hostname: String?, session: SSLSession?): Boolean {
return true // Noncompliant (s5527)
}
})
builder.hostnameVerifier(object : HostnameVerifier {
override fun verify(hostname: String?, session: SSLSession?): Boolean { // Compliant
if(something()) {
return false
} else {
return true
}
}
})
Code examples: https://github.com/SonarSource/security-expected-issues/pull/418
Attachments
Issue Links
- implements
-
RSPEC-5527 Server hostnames should be verified during SSL/TLS connections
- Active