EteSyncAndroid02.md

CogniCrypt (report 25) for EteSync

• Class: com.etesync.syncadapter.HttpClient$Builder

• Method: build

• Line: 233

• Issue details: RequiredPredicateError-2

  • RequiredPredicateError violating CrySL rule for javax.net.ssl.SSLContext.

  • First parameter was not properly generated as generated Key Managers.

Code

 val sslContext = SSLContext.getInstance("TLS")
 sslContext.init(
      if (keyManager != null) arrayOf(keyManager) else null,
      arrayOf(trustManager),
      null)
 orig.sslSocketFactory(sslContext.socketFactory, trustManager)
 orig.hostnameVerifier(hostnameVerifier)

 return HttpClient(orig.build(), certManager)
}

Questions

1. How likely might this warning reveal a security threat to this app?

   a. Very unlikely;

   b. Unlikely;

   c. I cannot evaluate this;

   d. Likely;

   e. Very likely;

2. Are you likely to accept a patch that fixes this particular issue?