android - Google Play 安全警报 - 您的应用使用了不安全的 HostnameVerifier 实现

Question

最近我的一个应用收到了来自 Google Play 的安全警报，如下所示。

您的应用使用了不安全的 HostnameVerifier 实现.并引用链接 Google Play Help Center有关漏洞修复和截止日期的详细信息的文章。

下面是我的代码。

HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier(){ 
    public boolean verify(String arg0, SSLSession arg1) {
        return true;
}}); 

任何人都可以举例说明，我应该做哪些更改来修复此警告？

Answer 1

此处相同 - 在 APK 中检测到不安全的主机名验证程序

Your app is using an unsafe implementation of HostnameVerifier. Please see this Google Help Center article for details, including the deadline for fixing the vulnerability. Im not using HostnameVerifier and not calling setDefaultHostnameVerifier. Moreover - Im using OKHTTP lib for http-requests. I hope that defining TrustManager will solve this issue.

因为我没有子类化 HostnameVerifier 或调用 setDefaultHostnameVerifier() 我假设它依赖于一些第 3 方库。由于我无法检测到这样的库，我想我会尝试使用以下代码添加一个类

HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
    public boolean verify(final String hostname, final SSLSession session) {
        if (/* check if SSL is really valid */)
            return true;
        else
            return false;
    }
});

到我的项目，看看它是否能解决问题。
所以我做到了，此外我还为每个 webView 添加了重写方法

@Override
public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
    // the main thing is to show dialog informing user
    // that SSL cert is invalid and prompt him to continue without 
    // protection: handler.proceed();
    // or cancel: handler.cancel();
    String message;
    switch(error.getPrimaryError()) {
        case SslError.SSL_DATE_INVALID:
            message = ResHelper.getString(R.string.ssl_cert_error_date_invalid);
            break;
        case SslError.SSL_EXPIRED:
            message = ResHelper.getString(R.string.ssl_cert_error_expired);
            break;
        case SslError.SSL_IDMISMATCH:
            message = ResHelper.getString(R.string.ssl_cert_error_idmismatch);
            break;
        case SslError.SSL_INVALID:
            message = ResHelper.getString(R.string.ssl_cert_error_invalid);
            break;
        case SslError.SSL_NOTYETVALID:
            message = ResHelper.getString(R.string.ssl_cert_error_not_yet_valid);
            break;
        case SslError.SSL_UNTRUSTED:
            message = ResHelper.getString(R.string.ssl_cert_error_untrusted);
            break;
        default:
            message = ResHelper.getString(R.string.ssl_cert_error_cert_invalid);
    }
    mSSLConnectionDialog = new MaterialDialog.Builder(getParentActivity())
            .title(R.string.ssl_cert_error_title)
            .content(message)
            .positiveText(R.string.continue_button)
            .negativeText(R.string.cancel_button)
            .titleColorRes(R.color.black)
            .positiveColorRes(R.color.main_red)
            .contentColorRes(R.color.comment_grey)
            .backgroundColorRes(R.color.sides_menu_gray)
            .onPositive(new MaterialDialog.SingleButtonCallback() {
                @Override
                public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                    mSSLConnectionDialog.dismiss();
                    handler.proceed();
                }
            })
            .onNegative(new MaterialDialog.SingleButtonCallback() {
                @Override
                public void onClick(MaterialDialog materialDialog, DialogAction dialogAction) {
                    handler.cancel();
                }
            })
            .build();
    mSSLConnectionDialog.show(); 
}

到

mWebView.setWebViewClient(new WebViewClient() {
... // other corresponding overridden methods
}

最后谷歌说:

SECURITY SCAN COMPLETE
No known vulnerabilities were detected for APK 158.

但是我不确定是什么代码生成的，HostNameVerifier 或 mWebView.setWebViewClient 的 onReceivedSslError()。注意:HostNameVerifier.setDefaultHostnameVerifier() 不应像您的代码中那样始终返回 true!它必须实现一些逻辑来检查它是否可以使用 SSL 并返回 true 或 false。这是必不可少的。