Search Issue Tracker
By Design
Votes
0
Found in
2018.3
2018.3.14f1
2018.4
2019.1
Issue ID
1190682
Regression
No
[2018.4] UnityWebRequest.java has a sHostnameVerifier which doesn't have server identity check implemented
UnityWebRequest.java has a sHostnameVerifier variable which doesn't have server identity check implemented.
Actual result: the verify boolean is just set to True.
Expected result: The verification happens and verify is set either to True or False.
Reproducible with: 2018.3, 2018.4, 2019.1.
Not reproducible with: 2019.2, 2019.3, 2020.1.
Notes:
- The issue is not reproducible with any repro steps, more information in the edits.
- The UnityWebRequest.java is implemented in 2018.3 and removed since 2019.2.
Add comment
All about bugs
View bugs we have successfully reproduced, and vote for the bugs you want to see fixed most urgently.
Latest issues
- “Remove Unused Overrides” available on not loaded Scene and throws “ArgumentException: The scene is not loaded” warning
- Adaptive Probe Volume occlusion edge is calculated incorrectly when viewing probes near geometry edges
- Sampling a texture using an HLSL file throws shader errors and the code does not compile
- "Graphics.CopyTexture called with null source texture" error when Base Camera of an Overlay Camera is removed with DX11 Graphics API and Compatibility Mode enabled
- WebGL sends wrong value with large numbers when SendMessage function is used
Resolution Note:
This issue is not so straight forward.
The mentioned sHostnameVerifier is only used when UnityWebRequest has a CertificateHandler attached to it. The point of CertificateHandler is to establish trust with the server, when it's attached, it is completely up to implementer of it to determine the trust.
Based on this it currently looks like a false positive from code analysis.
Unless it's proven to be impossible to implement hostname verification in a CertificateHandler.
Additional note: I've tried on a couple of different phones to access https://wrong.host.badssl.com/ which I believe is a showcase of such verification. The verifier was not called on either of them.