Skip to content
This repository has been archived by the owner on Jan 17, 2023. It is now read-only.

Commit

Permalink
Fixing failing test testNoPinningIsEnforcedForHTTPBinOrgIfNoCertifica…
Browse files Browse the repository at this point in the history 
…teIsPinned
  • Loading branch information
@mattt
mattt committed Jan 24, 2015
1 parent 0f3829f commit 104ce04
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion AFNetworking/AFSecurityPolicy.m
View file
Expand Up @@ -254,7 +254,7 @@ - (BOOL)evaluateServerTrust:(SecTrustRef)serverTrust

SecTrustSetPolicies(serverTrust, (__bridge CFArrayRef)policies);

if (!AFServerTrustIsValid(serverTrust) && !self.allowInvalidCertificates) {
if (self.SSLPinningMode != AFSSLPinningModeNone && !AFServerTrustIsValid(serverTrust) && !self.allowInvalidCertificates) {
return NO;
}

Expand Down

2 comments on commit 104ce04

@vagase
Copy link

@vagase vagase commented on 104ce04 Mar 9, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi Mattt,

This fix will cause 'allowInvalidCertificates' parameter to be ignored, and return true for both valid and invalid serverTrusts whatever 'allowInvalidCertificates' is.

Since 'AFSSLPinningModeNone' is the default mode, this will cause serious security issue, for it will let all invalid serverTrusts pass the test by default. I don't think this is what developers expect.

@yas375
Copy link

@yas375 yas375 commented on 104ce04 Mar 27, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@vagase good job on noticing this! 👍

http://blog.mindedsecurity.com/2015/03/ssl-mitm-attack-in-afnetworking-251-do.html

Please sign in to comment.