Rules / Kotlin
SHIELD-KOTLIN-014
Trust-all TrustManager or HostnameVerifier disables TLS validation
What it detects
An empty checkServerTrusted implementation or a HostnameVerifier that always returns true disables certificate validation and enables MITM.
How to fix
Perform full certificate and hostname validation; use certificate pinning for sensitive connections.
Vulnerable — Shield flags thisHttpClientFactory.kt
import javax.net.ssl.HostnameVerifier
import javax.net.ssl.HttpsURLConnection
fun disableTlsChecks() {
val insecure = HostnameVerifier { _, _ -> true }
HttpsURLConnection.setDefaultHostnameVerifier(insecure)
}
Fixed — scans cleanHttpClientFactory.kt
import okhttp3.CertificatePinner
import okhttp3.OkHttpClient
// Default certificate + hostname validation stays enabled; pin the backend cert.
fun buildClient(): OkHttpClient {
val pinner = CertificatePinner.Builder()
.add("api.example.com", "sha256/EXAMPLEPINEXAMPLEPINEXAMPLEPINEXAMPLEPIN00=")
.build()
return OkHttpClient.Builder().certificatePinner(pinner).build()
}
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-014, the fixed one does not.