Android 应用漏洞 - HostnameVerifier，不在代码库中的任何位置

Question

提交到 Google Play 商店后，我收到一封电子邮件通知，告诉我我的 APK 正在使用 HostnameVerifier 接口(interface)的不安全实现。
我根本找不到在代码中使用 HostnameVerifier 的任何地方，因此无法将其删除。我认为它在一个包中，但我所做的任何升级，似乎都无法修复它。有人可以指出我解决此漏洞的正确方向吗
这是我的项目级 build.gradle 文件:

buildscript {
    ext.kotlin_version = '1.4.10'
    repositories {
        google()
        jcenter()
        mavenCentral()
        maven {
            url "https://cardinalcommerce.bintray.com/android"
        }

    }
dependencies {
    classpath 'com.android.tools.build:gradle:4.0.1'
    classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
    classpath "io.realm:realm-gradle-plugin:7.0.5"
    classpath 'com.google.gms:google-services:4.3.4'
    classpath 'com.google.zxing:android-core:3.3.0'
    classpath 'com.apollographql.apollo:apollo-gradle-plugin:1.3.2'
    classpath 'com.google.firebase:firebase-crashlytics-gradle:2.3.0'
   }
}

allprojects {
    repositories {
        google()
        jcenter()
    }
}

这是我的应用级 build.gradle 文件:

apply plugin: 'com.android.application'

apply plugin: 'kotlin-android'
apply plugin: 'kotlin-android-extensions'
apply plugin: 'kotlin-kapt'

apply plugin: 'realm-android'

apply plugin: 'com.apollographql.apollo'

apply plugin: 'com.google.gms.google-services'
apply plugin: 'com.google.firebase.crashlytics'

android {
    compileSdkVersion 29
    defaultConfig {
        applicationId "*****"
        minSdkVersion(23)
        targetSdkVersion 29
        versionCode 99
        versionName "4.3.4"
        testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
        renderscriptSupportModeEnabled true
        renderscriptTargetApi 22
        multiDexEnabled true
    }
    packagingOptions {
        exclude 'META-INF/DEPENDENCIES'
        exclude 'META-INF/LICENSE'
        exclude 'META-INF/LICENSE.txt'
        exclude 'META-INF/license.txt'
        exclude 'META-INF/NOTICE'
        exclude 'META-INF/NOTICE.txt'
        exclude 'META-INF/notice.txt'
        exclude 'META-INF/ASL2.0'
    }
    signingConfigs {
        release {
            storeFile file(RELEASE_STORE_FILE)
            storePassword RELEASE_STORE_PASSWORD
            keyAlias RELEASE_KEY_ALIAS
            keyPassword RELEASE_KEY_PASSWORD
        }
    }
    compileOptions {
        sourceCompatibility JavaVersion.VERSION_1_8
        targetCompatibility JavaVersion.VERSION_1_8
    }
    buildTypes {
        release {
            minifyEnabled false
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
            buildConfigField 'String', 'BASE_URL', '"https://api.examplewebsite.net/"'
            buildConfigField 'String', 'BASE_WEB_URL', '"https://www.examplewebsite.net/"'
            buildConfigField 'Boolean', 'USES_ENCRYPTION', 'true'
            signingConfig signingConfigs.release
        }
        debug {
            debuggable true
            buildConfigField 'String', 'BASE_URL', '"https://uat-api.examplewebsite.net/"'
            buildConfigField 'String', 'BASE_WEB_URL', '"https://uat.examplewebsite.net/"'
            buildConfigField 'Boolean', 'USES_ENCRYPTION', 'false'
        }
    }
}

repositories {
    maven { url 'https://github.com/uPhyca/stetho-realm/raw/master/maven-repo' }
    maven { url "https://jitpack.io" }
    maven { url 'https://repo.spring.io/libs-milestone' }
    maven { url "https://cardinalcommerce.bintray.com/android" }
    jcenter()
}

dependencies {
    implementation fileTree(dir: 'libs', include: ['*.jar'])
    implementation "org.jetbrains.kotlin:kotlin-stdlib-jdk7:$kotlin_version"
    implementation 'androidx.appcompat:appcompat:1.1.0'
    implementation 'androidx.legacy:legacy-support-v4:1.0.0'
    implementation 'androidx.media:media:1.0.1'
    implementation 'androidx.vectordrawable:vectordrawable-animated:1.0.0'
    implementation 'androidx.browser:browser:1.0.0'
    implementation 'androidx.constraintlayout:constraintlayout:1.1.3'
    implementation 'com.google.firebase:firebase-invites:17.0.0'
    implementation 'com.google.firebase:firebase-core:17.0.1'
    implementation 'com.google.firebase:firebase-config:19.2.0'
    implementation 'androidx.recyclerview:recyclerview:1.1.0'
    testImplementation 'junit:junit:4.12'
    androidTestImplementation 'androidx.test:runner:1.2.0'
    androidTestImplementation 'androidx.test.espresso:espresso-core:3.2.0'
    implementation 'com.android.support:appcompat-v7'
    implementation 'com.google.android.material:material:1.0.0'
    implementation 'com.android.support:recyclerview-v7'
    implementation 'com.squareup.retrofit2:retrofit:2.0.2'
    implementation 'com.squareup.retrofit2:converter-gson:2.0.2'
    implementation 'com.squareup.picasso:picasso:2.71828'
    implementation 'com.squareup.okhttp3:logging-interceptor:3.10.0'
    implementation 'com.google.dagger:dagger:2.27'
    implementation "org.jetbrains.anko:anko:0.10.1"
    implementation 'org.springframework.android:spring-android-rest-template:2.0.0.M3'
    implementation 'com.facebook.android:facebook-android-sdk:6.1.0'
    implementation group: 'com.madgag.spongycastle', name: 'bctls-jdk15on', version: '1.58.0.0'
    implementation 'com.google.android.gms:play-services-analytics:17.0.0'
    implementation 'com.github.ittianyu:BottomNavigationViewEx:2.0.2'
    kapt 'com.google.dagger:dagger-compiler:2.20'
    kapt 'androidx.lifecycle:lifecycle-compiler:2.0.0'
    implementation 'androidx.lifecycle:lifecycle-extensions:2.0.0'
    implementation 'com.braintreepayments:popup-bridge:2.0.0'
    androidTestImplementation 'org.mockito:mockito-android:2.25.1'
    androidTestImplementation "com.nhaarman:mockito-kotlin:1.5.0"
    androidTestImplementation('androidx.test.espresso:espresso-core:3.1.0', {
        exclude group: 'com.android.support', module: 'support-annotations'
    })
    implementation 'com.google.android.gms:play-services-wallet:18.1.2'
    implementation 'com.braintreepayments.api:braintree:3.7.0'
    implementation 'com.braintreepayments.api:google-payment:3.2.0'
    implementation 'com.braintreepayments.api:drop-in:4.4.1'
    implementation 'com.braintreepayments.api:three-d-secure:3.7.0'
    implementation 'com.apollographql.apollo:apollo-runtime:1.3.2'
    implementation 'org.jetbrains.kotlinx:kotlinx-coroutines-core:1.3.3'
    implementation "androidx.preference:preference-ktx:1.1.0"
    implementation 'com.auth0.android:jwtdecode:2.0.0'
    implementation 'com.google.firebase:firebase-crashlytics:17.2.2'
    implementation 'com.google.firebase:firebase-analytics:17.6.0'

}

apply plugin: 'com.google.gms.google-services'

apollo {
    generateKotlinModels.set(true) // or false for Java models
}

Answer 1

在我的情况下，Braintree SDK 中的库(lib.android.paypal)是导致此问题的原因。可能通过更新已修复此 HostnameVerifier 的 Braintree SDK 也可以解决您的漏洞问题。