InsecureAndroidTrustManager.kt allows Man In The Middle attack
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 48/100
Research direction
Start with InsecureAndroidTrustManager.kt and read checkServerTrusted() to understand when it returns an empty certificate list. Then look for tests covering this trust-manager behavior; done means the insecure-host path no longer permits the MITM-enabling behavior described in the issue.
Written by the indexing model from the issue text.
Description
checkServerTrusted() returns an empty list of certificates if the host is insecure, which allows for MITM.
- Dominant language
- Kotlin
- Stars
- 47.1k
- Forks
- 9.3k
- Avg merge
- 18h 18m
- Merged PRs (30d)
- 15
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from lysine-dev/okhttp
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
lysine-dev/okhttp#9788 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
lysine-dev/okhttp#9761 · 3 comments ·
Maintainers usually reply within 1 day
-
Remove crossinline `addInterceptor` and `addNetworkInterceptor` overloadsPossibly taken @Amir-Golmoradi claimed this 6 days ago. Openenhancement
Difficulty 3/5 1-2 days Newbie friendliness 58/100
lysine-dev/okhttp#9779 · 1 comment ·
Maintainers usually reply within 1 day
-
HTTP/2 Data padding is not counted toward the connection flow-control window. This deadlocks connections with peers that pad.Possibly taken @Amir-Golmoradi claimed this 6 days ago. Openbug
Difficulty 3/5 1-2 days Newbie friendliness 67/100
lysine-dev/okhttp#9772 · 4 comments ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
lysine-dev/okhttp#9760 · 3 comments ·
Maintainers usually reply within 1 day
All issues in lysine-dev/okhttp
Similar issues
-
afk-ok area:data-quality importer size:S
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
enorm-labs/event-junkie#3301 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
rustyrazorblade/easy-db-lab#1017 ·
Maintainers usually reply within 1 day
-
enhancement impact:U1 later P3 reach:R2 size:S
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100