Zennoxa Shield
Rules / Kotlin
SHIELD-KOTLIN-014

Trust-all TrustManager or HostnameVerifier disables TLS validation

criticalKotlinCWE-295CVSS 9.1

What it detects

An empty checkServerTrusted implementation or a HostnameVerifier that always returns true disables certificate validation and enables MITM.

How to fix

Perform full certificate and hostname validation; use certificate pinning for sensitive connections.

Vulnerable — Shield flags thisHttpClientFactory.kt
import javax.net.ssl.HostnameVerifier
import javax.net.ssl.HttpsURLConnection

fun disableTlsChecks() {
    val insecure = HostnameVerifier { _, _ -> true }
    HttpsURLConnection.setDefaultHostnameVerifier(insecure)
}
Fixed — scans cleanHttpClientFactory.kt
import okhttp3.CertificatePinner
import okhttp3.OkHttpClient

// Default certificate + hostname validation stays enabled; pin the backend cert.
fun buildClient(): OkHttpClient {
    val pinner = CertificatePinner.Builder()
        .add("api.example.com", "sha256/EXAMPLEPINEXAMPLEPINEXAMPLEPINEXAMPLEPIN00=")
        .build()
    return OkHttpClient.Builder().certificatePinner(pinner).build()
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-014, the fixed one does not.

SHIELD-KOTLIN-014: Trust-all TrustManager or HostnameVerifier disables TLS validation — Zennoxa Shield