不安全的 HostnameVerifier
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
OWASP 類別：MASVS-CODE：程式碼品質
總覽
HostnameVerifier 實作會負責驗證伺服器憑證中的主機名稱，是否與用戶端嘗試連線的伺服器主機名稱相符。
Android 應用程式中的不安全 HostnameVerifier 實作是指，該實作無法正確驗證與應用程式通訊的伺服器主機名稱。這可能會讓攻擊者冒用合法伺服器，誘騙應用程式傳送機密資料給攻擊者。
會有這個安全漏洞，是因為 HostnameVerifier 類別具有可略過 X.509 憑證主機名稱驗證程序的函式呼叫，而只會驗證憑證的雜湊值。常見的誤解是，SSLSession#isValid 函式會執行安全性相關作業，實際上，這項作業只會檢查工作階段是否有效且可供繼續使用或加入；這兩者都不會驗證工作階段的「安全性」。HostnameVerifier 類別已由 NetworkSecurityConfig 取代。
影響
不安全的 HostnameVerifier 實作可能會產生安全漏洞，可用於針對受害者應用程式的網路流量執行 MiTM (中間人) 攻擊。如果濫用這個不安全的程式碼，遠端或本機網路攻擊者會在觸發此程式碼時，入侵使用者的應用程式網路資料。影響程度取決於不小心曝露的網路流量內容 (PII、私人資訊、敏感工作階段值、服務憑證等)。
因應措施
使用 NetworkSecurityConfig.xml 功能，確保所有實際工作環境、測試、偵錯和開發階段連線都能正確處理，而不要使用或實作自訂傳輸層安全標準 (TLS)/安全資料傳輸層 (SSL) 憑證驗證程式碼。
資源
這個頁面中的內容和程式碼範例均受《內容授權》中的授權所規範。Java 與 OpenJDK 是 Oracle 和/或其關係企業的商標或註冊商標。
上次更新時間：2024-01-05 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2024-01-05 (世界標準時間)。"],[],[],null,["# Unsafe HostnameVerifier\n\n\u003cbr /\u003e\n\n**OWASP category:** [MASVS-CODE: Code Quality](https://mas.owasp.org/MASVS/10-MASVS-CODE)\n\nOverview\n--------\n\nThe [`HostnameVerifier`](/reference/javax/net/ssl/HostnameVerifier#verify(java.lang.String,%20javax.net.ssl.SSLSession)) implementation is responsible for verifying that the\nhostname in the server's certificate matches the hostname of the server that the\nclient is trying to connect to.\n\nAn unsafe HostnameVerifier implementation in an Android application is an\nimplementation that does not properly verify the hostname of the server with\nwhich the application is communicating. This can allow an attacker to\nimpersonate a legitimate server and trick the application into sending sensitive\ndata to the attacker.\n\nThis vulnerability exists because the `HostnameVerifier` class has function\ncalls that can skip X.509 certificate hostname validation and, instead, only\nverify the hash of the certificate. A common misconception is that the\n[`SSLSession#isValid`](/reference/javax/net/ssl/SSLSession#isValid()) function performs a security-related operation, when\nin reality its purpose is only to check if a session is valid and available for\nresuming or joining; neither of which validate the *security* of a session. The\nHostnameVerifier class has been superseded by [NetworkSecurityConfig](/training/articles/security-config).\n\nImpact\n------\n\nUnsafe HostnameVerifier implementations can lead to vulnerabilities which can be\nused to perform MiTM (Man-in-The-Middle) attacks on network traffic from the\nvictim application. The impact of exploiting this insecure code is that a user's\napplication network data can be compromised by network attackers (remotely or\nlocally) if this code is triggered. The impact is dependent on the content of\nthe network traffic being inadvertently exposed (PII, private information,\nsensitive session values, service credentials, etc).\n\nMitigations\n-----------\n\nUse the [NetworkSecurityConfig.xml](/training/articles/security-config) to ensure that all\nproduction, testing, debugging, and dev stage connections are properly handled\nrather than using or implementing custom TLS/SSL certificate validation code.\n\nResources\n---------\n\n- [Network Security Configuration Documentation](/training/articles/security-config)\n- [This check looks for implementations of HostnameVerifier whose verify method always returns true (thus trusting any hostname)](https://googlesamples.github.io/android-custom-lint-rules/checks/BadHostnameVerifier.md.html)\n- [Developer documentation for the HostnameVerifier class](/reference/javax/net/ssl/HostnameVerifier#verify(java.lang.String,%20javax.net.ssl.SSLSession))\n- [AllowAllHostnameVerifierDetector class in Android](https://cs.android.com/android-studio/platform/tools/base/+/mirror-goog-studio-main:lint/libs/lint-checks/src/main/java/com/android/tools/lint/checks/AllowAllHostnameVerifierDetector.java)"]]
