Potential HTTP APIs misuses about android HOT 4 CLOSED

Please report to: security @ the domain

Though I guess that since you already gave a link to the analyzer used to find things it's public knowledge anyway, so you may as well just post it here and we can have a discussion here.

I find it quite unlikely that there are real issues though, because this application doesn't actually power the cryptographic code in EteSync. The code is written in Rust and resides in Etebase-Java...

from android.

Hello @tasn,

From the 32 warnings that CogniCrypt reported, we selected 5 gists to share with you. Four of them are related to the class HTTPClient.kt. The remaining warnings are related to third-party libraries. As an example, I'm sharing with you the Gist 05 related to okio/ByteString.kt.

Gist 01 - SSLContext
Gist 02 - SSLContext
Gist 03 - KeyStore
Gist 04 - SSLContext
Gist 05 - MessageDigest

For any doubts, you can comment here and/or directly in the gists and we can clarify the issues.

Please let me know whether you are interested in receiving the complete report with the remaining warnings related to third-party libraries used by etesync/Android.

Best regards,

from android.

Please, report this spammer. This is just a bot spamming the very same message to tons of open source repositories. The only things that are changed in the message are the repository's name and the amount of warnings.

from android.

I don't think you can report spammers, no?

But anyway, closing this ticket, as it was nonsense from the start.

from android.