Skip to content

Commit 6630d9e

Browse files
bric3bric3
committed
fix: Forbid OkHostnameVerifier to prevent accidental use, CVE-2021-0341
See #11631
1 parent 3efef48 commit 6630d9e

1 file changed

Lines changed: 7 additions & 0 deletions

File tree

‎gradle/forbiddenApiFilters/main.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,3 +56,10 @@ java.lang.invoke.MethodHandles.Lookup#unreflectSetter(java.lang.reflect.Field)
5656

5757
# avoid Java deserialization entrypoint - see warning in https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/io/ObjectInputStream.html
5858
java.io.ObjectInputStream#readObject()
59+
60+
# CVE-2021-0341: The internal OkHostnameVerifier.verify(String, SSLSession) does not restrict hostnames to ASCII,
61+
# allowing crafted unicode hostnames to bypass validation. Use the normal (public API) OkHttp connection flow via
62+
# HttpUrl instead, which ensures only ASCII characters reach the verifier.
63+
@defaultMessage Do not use OkHostnameVerifier directly — it is an internal OkHttp class. Use the normal OkHttp connection flow via HttpUrl (CVE-2021-0341)
64+
okhttp3.internal.tls.OkHostnameVerifier
65+
datadog.okhttp3.internal.tls.OkHostnameVerifier

0 commit comments

Comments
 (0)