不安全的 X.509 TrustManager
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
OWASP 類別：MASVS-CODE：程式碼品質
總覽
X509TrustManager 類別的職責是驗證遠端伺服器的真實性。要做到這一點，方法是驗證伺服器憑證。
Android 應用程式中的不安全 X509TrustManager 實作則指，該實作無法正確驗證與應用程式通訊的伺服器真實性。這可能會讓攻擊者冒用合法伺服器，誘騙應用程式傳送機密資料給攻擊者。
之所以會有安全漏洞，是因為一旦使用 X509TrustManager 類別，Java 和 Android 就會允許完整覆寫伺服器驗證作業。X509TrustManager 類別有兩個利益關係函式：checkServerTrusted() 和 getAcceptedIssuers()。這些函式呼叫可設為信任所有 X.509 憑證。但自訂驗證邏輯可能容易發生問題或不完整，且會允許非預期的連線。在上述這些情況下，使用該類別就不再有意義，而透過 X509TrustManager 輸出內容建立的會是不安全的網路連線。
影響
不安全的 X509TrustManager 實作可能會產生安全漏洞，可用於針對受害應用程式的網路流量執行 MitM (中間人) 攻擊。如果濫用這個不安全的程式碼，遠端或本機網路攻擊者會在觸發此程式碼時，入侵使用者的應用程式網路資料。影響程度取決於不小心曝露的網路流量內容 (PII、私人資訊、敏感工作階段值、服務憑證等)。
因應措施
使用 NetworkSecurityConfig.xml 功能，確保所有實際工作環境、測試、偵錯和開發階段連線都能正確處理，而不要使用或實作自訂傳輸層安全標準 (TLS)/安全資料傳輸層 (SSL) 憑證驗證程式碼。如果測試和偵錯版本需要使用自行簽署的憑證，請考慮使用 NetworkSecurityConfig，而不要實作自訂的 X509TrustManager。
資源
這個頁面中的內容和程式碼範例均受《內容授權》中的授權所規範。Java 與 OpenJDK 是 Oracle 和/或其關係企業的商標或註冊商標。
上次更新時間：2024-01-05 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2024-01-05 (世界標準時間)。"],[],[],null,["# Unsafe X509TrustManager\n\n\u003cbr /\u003e\n\n**OWASP category:** [MASVS-CODE: Code Quality](https://mas.owasp.org/MASVS/10-MASVS-CODE)\n\nOverview\n--------\n\nThe `X509TrustManager` class is responsible for verifying the authenticity of a\nremote server. It does this by validating the server's certificate.\n\nAn insecure `X509TrustManager` implementation in an Android application is an\nimplementation that does not properly verify the authenticity of the server with\nwhich the application is communicating. This can allow an attacker to\nimpersonate a legitimate server and trick the application into sending sensitive\ndata to the attacker.\n\nThe vulnerability exists because using the [`X509TrustManager`](/reference/javax/net/ssl/X509TrustManager#checkServerTrusted(java.security.cert.X509Certificate%5B%5D,%20java.lang.String)) class,\nJava/Android allows the complete overriding of server verification. The\n`X509TrustManager` class has two functions of interest:\n[`checkServerTrusted()`](/reference/javax/net/ssl/X509TrustManager#checkServerTrusted(java.security.cert.X509Certificate%5B%5D,%20java.lang.String)) and [`getAcceptedIssuers()`](/reference/javax/net/ssl/X509TrustManager#getAcceptedIssuers()). These function\ncalls can be configured to trust all X.509 certificates. Finally, custom\nvalidation logic may be buggy or incomplete and permit unexpected connections.\nIn all these cases, the purpose of the class has been negated and the network\nconnection established based on the `X509TrustManager` output is not secure.\n\nImpact\n------\n\nUnsafe X509TrustManager implementations can lead to vulnerabilities which can be\nused to perform MitM (Man-in-the-Middle) attacks on network traffic from the\nvictim application. The impact of exploiting this insecure code is that a user's\napplication network data can be compromised by network attackers (remotely or\nlocally) if this code is triggered. The impact is dependent on the content of\nthe network traffic being inadvertently exposed (PII, private information,\nsensitive session values, service credentials, etc).\n\nMitigations\n-----------\n\nUse the [NetworkSecurityConfig.xml](/training/articles/security-config) functionality to ensure that all\nproduction, testing, debugging, and dev stage connections are properly handled\nrather than using or implementing custom TLS/SSL certificate validation code. If\nusing a self-signed certificate is needed for test and debug builds, consider\nusing NetworkSecurityConfig instead of implementing a custom `X509TrustManager`.\n\nResources\n---------\n\n- [Play Warning docs](https://support.google.com/faqs/answer/6346016)\n- [Documentation to assist configuring the Network security configuration xml file.](/training/articles/security-config)\n- [Developer documentation for the TrustManager class.](/reference/javax/net/ssl/TrustManager)\n- [This check looks for X.509TrustManager implementations whose checkServerTrusted or checkClientTrusted methods do nothing (thus trusting any certificate chain).](https://googlesamples.github.io/android-custom-lint-rules/checks/TrustAllX509TrustManager.md.html)\n- [This check looks for custom X.509TrustManager implementations.](https://googlesamples.github.io/android-custom-lint-rules/checks/CustomX509TrustManager.md.html)\n- \u003chttps://cs.android.com/android-studio/platform/tools/base/+/mirror-goog-studio-main:lint/libs/lint-checks/src/main/java/com/android/tools/lint/checks/X509TrustManagerDetector.java\u003e"]]
