Google Play Blocker: Unsafe HostnameVerifier Defined

[subinkrishna]

OS:

• Windows
• MacOS
• Linux

Platform:

• iOS
• Android

SDK:

• @sentry/react-native
• react-native-sentry

SDK version: 1.2.1
react-native version: 0.61.4

Are you using Expo?

• Yes
• No

Are you using sentry.io or on-premise?

• sentry.io (SaaS)
• on-premise

Configuration:

Sentry.init({
  dsn: 'https://[email protected]/...'
});

---

We did a DataTheorem scan of our app and it identified unsafe implementation & HostnameVerifier

The following classes within the App define an insecure HostnameVerifier) that disables SSL hostname validation:

io.sentry.connection.HttpConnection$1

Regardless of whether the affected classes are actually used at runtime or not, Google Play is blocking any App that defines such an insecure HostnameVerifier, as detailed on Google’s support page :

“Beginning March 1, 2017, Google Play will block publishing of any new apps or updates that use an unsafe implementation of HostnameVerifier.”

[marandaneto]

dup of getsentry/sentry-java/issues/840