🔒 Fix global hostname verification vulnerability #30
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR addresses a critical security vulnerability where
HttpsURLConnection.setDefaultHostnameVerifierwas being set to trust all hostnames globally when the "Ignore SSL Errors" preference was enabled. This exposed the entire application to Man-in-the-Middle (MitM) attacks.Changes:
app/src/main/java/io/aatricks/novelscraper/data/repository/source/BaseJsoupSource.kt: Removed the lines that set the global default hostname verifier to always returntrue. The per-connectionsslSocketFactorysetting is preserved to allow trusting self-signed certificates (if desired) but without compromising hostname verification.app/src/main/java/io/aatricks/novelscraper/data/repository/source/NovelFireSource.kt: RefactoredsearchNovelsto use the injectedokHttpClientdirectly instead of theconnect()helper method. This improves safety and leverages the modern HTTP client.app/src/test/java/io/aatricks/novelscraper/data/repository/source/BaseJsoupSourceSecurityTest.kt: Added a new test file to verify that the fix works and that the global hostname verifier remains secure (rejects invalid hostnames) even when the vulnerable code path is triggered.Risk:
PR created automatically by Jules for task 2708113590480199099 started by @Aatricks