[jpantonow]

Affects RESTMusicService.<init> in app/src/main/java/github/paroj/dsub2000/service/RESTMusicService.java.

I found that RESTMusicService built an anonymous trust manager with empty certificate checks and passed it to SSLContext.init. It also installed a hostname verifier that accepted every hostname, which does not meet the SSLContextSpec usage rule requiring trust managers from a TrustManagerFactory.

I replaced those components with trust managers initialized from the platform default trust store and the default hostname verifier. The existing HTTPS configuration path and public getters remain, but now return platform-validating components. If TLS-context initialization fails, the service retains the platform default socket factory and logs a warning.

I found this while running the app under RVSec, a runtime checker for how apps use the Java crypto and TLS APIs.

The project builds with this change (:app:assembleFlossDebug).

One thing to decide: with this change the "allow insecure connections" setting no longer skips certificate checks, so a server with a self-signed certificate will only connect if its certificate is installed on the device. If you'd rather keep that option working, I can limit the change to the default path. This follows up on #177.

I'm a Computer Engineering student at the University of Brasília (UnB), working on a research project on Android app analysis. Happy to adjust this to the project's conventions.

[paroj]

skipping certificate checks is the whole point here. When that setting is off the default path should also be good already, no?

[jpantonow]

skipping certificate checks is the whole point here. When that setting is off the default path should also be good already, no?

You're right — I re-checked: with the setting off, the connection already uses the platform socket factory and hostname verifier, and the trust-all context is only applied when the user opts in. The analysis flagged it because the context is built in the constructor regardless of the setting, but that isn't a problem in the default path. I'll close this; sorry for the noise.