Zennoxa Shield
Rules / Java
SHIELD-JAVA-014

Trust-All TLS HostnameVerifier

criticalJavaCWE-295CVSS 9.1

What it detects

A HostnameVerifier that returns true unconditionally disables TLS host validation.

How to fix

Remove the custom verifier and rely on the default hostname verification.

Vulnerable — Shield flags thisApiClient.java
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLSession;

public class ApiClient {
    static {
        HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
            public boolean verify(String hostname, SSLSession session) { return true; }
        });
    }
}
Fixed — scans cleanApiClient.java
import javax.net.ssl.HttpsURLConnection;
import java.net.URI;

public class ApiClient {
    public HttpsURLConnection open(String path) throws Exception {
        URI uri = URI.create("https://api.example.com" + path);
        // Default JDK hostname verification stays active; no custom HostnameVerifier.
        return (HttpsURLConnection) uri.toURL().openConnection();
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-014, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-014: Trust-All TLS HostnameVerifier — Zennoxa Shield