wultra / ssl-pinning-android

Android SDK for our dynamic SSL pinning
Apache License 2.0
60 stars 8 forks source link

Infinite stacking of cached same certificates with updates #65

Closed vstudnicka-cen66454 closed 1 year ago

vstudnicka-cen66454 commented 2 years ago

CertStore.kt -> private fun processReceivedData(...) -> updateCachedData { cachedData -> ... }

This does check not work: if (newCertificates.indexOf(newCertificateInfo) != -1) { // skip entry that's already in the database continue }

Everytime it downloads trustlist it is checking if certificate is already in array. For every CertificateInfo it is creating new object and this code above is checking if same object is already in cachced array, but not comparing its data but only if it is same object. This results in in adding same certificate everytime it updates as it is always a newly created CerticateInfo object

image

petrdvorak commented 2 years ago

@vstudnicka-cen66454 Thank you for reporting, adding @TomasKypta.

tanvir-retailai commented 1 year ago

@petrdvorak any update on this ticket?