HostnameVerifier Accepts All

Vulnerable vs. safe

public boolean verify(String hostname, SSLSession session) { return true; }

public boolean verify(String hostname, SSLSession session) { return defaultHv.verify(hostname, session); }

Why it matters & how to fix it

This HostnameVerifier unconditionally returns true, so the certificate's hostname is never checked and a valid certificate for any host is accepted (CWE-295). Combined with TLS this permits man-in-the-middle. Remove the override and rely on the default hostname verification, or implement a check that actually compares the requested host to the certificate.

References

• https://cwe.mitre.org/data/definitions/295.html

Related checks

• JavaScript / TypeScript - Other Security Checks
  Child Process Shell True
• JavaScript / TypeScript - Other Security Checks
  Open Redirect Tainted Input
• Python - Other Security Checks
  Django Mark Safe
• Python - Other Security Checks
  Flask Debug Enabled
• Python - Other Security Checks
  Flask Render Template String
• Python - Other Security Checks
  Insecure Tempfile Mktemp