How to fix apps containing an unsafe implementation of TrustManager

Question

I am trying to make my Android apps comply with Android's new policy of having secure apps per this requirement and instructions.

1) I first added SSL and https to the urls in my app 2) Then I started using the class HttpsURLConnection instead of HttpURLConnection

Here is an example of remote call that I use:

   public void sendFeedback(String name , String email , String password ) 
   {  
        String[] params = new String[] { "https://www.problemio.com/auth/create_profile_mobile.php", name , email , password };

        DownloadWebPageTask task = new DownloadWebPageTask();
        task.execute(params);        
   }

   public class DownloadWebPageTask extends AsyncTask<String, Void, String> 
   {       
        private boolean connectionError = false;


     @Override
     protected void onPreExecute( ) 
     {
          dialog = new Dialog(CreateProfileActivity.this);

          dialog.setContentView(R.layout.please_wait);
          dialog.setTitle("Creating Profile");

          TextView text = (TextView) dialog.findViewById(R.id.please_wait_text);
          text.setText("Please wait while your profile is created... ");
          dialog.show();
     }             

    @Override
    protected String doInBackground(String... theParams) 
    {
        String myUrl = theParams[0];
        final String name = theParams[1];
        final String email = theParams[2];
        final String password = theParams[3];

        String charset = "UTF-8";                       
        String response = null;

        try 
        {               
            String query = String.format("name=%s&email=%s&password=%s", 
                     URLEncoder.encode(name, charset), 
                     URLEncoder.encode(email, charset), 
                     URLEncoder.encode(password, charset));

            final URL url = new URL( myUrl + "?" + query );

            final HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();

            conn.setDoOutput(true); 
            conn.setRequestMethod("POST");

            conn.setDoOutput(true);

            conn.setUseCaches(false);

            conn.connect();

            final InputStream is = conn.getInputStream();
            final byte[] buffer = new byte[8196];
            int readCount;
            final StringBuilder builder = new StringBuilder();
            while ((readCount = is.read(buffer)) > -1) 
            {
                builder.append(new String(buffer, 0, readCount));
            }

            response = builder.toString();      
        } 
        catch (Exception e) 
        {
              connectionError = true;
        }

        return response;
    }

    @Override
    protected void onPostExecute(String result) 
    {       
        // Some code

            // Make an intent to go to the home screen
            Intent myIntent = new Intent(CreateProfileActivity.this, MainActivity.class);
            CreateProfileActivity.this.startActivity(myIntent);
        }
    }    
}

But it didn't remove the warning sign on my developer console. Any idea what I am doing wrong and how to fix this?

Answer 1

Assuming Google's scanner is not broken, the X509TrustManager that it complains about can come from one of two places.

It could be from your own source code. Usually, you will remember doing this, because you typed in implements X509TrustManager in a class somewhere and override a bunch of icky-looking methods. A quick search through your source code should determine if this is the case.

If not, it is from some library. Many — hopefully most — libraries will have cleaned this up. However, it may be cleaned up only in newer editions of the library than you are presently using, either because you have an old version listed in your dependencies, or you are using a local JAR or something. The bad news is that tracking down the culprit here can be a pain, though it will be limited to libraries that need Internet access (e.g., recyclerview-v7 will not be a problem). The good news is that fixing the issue may be as simple as updating the library, or removing it if it is cruft from past implementations of your app that you are no longer using.

While I cannot speak regarding Flurry, this problem did exist in an old version of ACRA. There have been a variety of other fixes to ACRA in recent months, and so I would recommend that you upgrade to the current edition anyway.