Skip to content

Commit

Permalink
Fix quotes (#3043)
Browse files Browse the repository at this point in the history
  • Loading branch information
titze authored Nov 6, 2024
1 parent ee12353 commit 7d2c88f
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 4 deletions.
6 changes: 3 additions & 3 deletions tests-beta/android/MASVS-NETWORK/MASTG-TEST-0217.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ weakness: MASWE-0050

## Overview

The Android Network Security Configuration does not provide direct control over specific TLS versions (unlike ["iOS"](https://developer.apple.com/documentation/bundleresources/information_property_list/nsexceptionminimumtlsversion)), and starting with Android 10, [TLS v1.3 is enabled by default](https://developer.android.com/privacy-and-security/security-ssl#Updates%20to%20SSL) for all TLS connections.
The Android Network Security Configuration does not provide direct control over specific TLS versions (unlike [iOS](https://developer.apple.com/documentation/bundleresources/information_property_list/nsexceptionminimumtlsversion)), and starting with Android 10, [TLS v1.3 is enabled by default](https://developer.android.com/privacy-and-security/security-ssl#Updates%20to%20SSL) for all TLS connections.

There are still several ways to enable insecure versions of TLS, including:

Expand All @@ -22,7 +22,7 @@ Some third-party libraries, such as [OkHttp](https://square.github.io/okhttp/),

For example, using `ConnectionSpec.COMPATIBLE_TLS` in OkHttp (via `okhttp3.ConnectionSpec.Builder.connectionSpecs(...)`) can lead to insecure TLS versions, like TLS 1.1, being enabled by default in certain versions. Refer to OkHttp's [configuration history](https://square.github.io/okhttp/security/tls_configuration_history/) for details on supported protocols.

The API call `okhttp3.ConnectionSpec.Builder.tlsVersions(...)` can also be used to set the enabled protocols (["OkHttp documentation"](https://square.github.io/okhttp/features/https/)).
The API call `okhttp3.ConnectionSpec.Builder.tlsVersions(...)` can also be used to set the enabled protocols ([OkHttp documentation](https://square.github.io/okhttp/features/https/)).

## Steps

Expand All @@ -35,4 +35,4 @@ The output contains a list of all enabled TLS versions in the above mentioned AP

## Evaluation

The test case fails if any ["insecure TLS version"](https://mas.owasp.org/MASTG/0x04f-Testing-Network-Communication/#recommended-tls-settings) is directly enabled, or if the app enabled any settings allowing the use of outdated TLS versions, such as `okhttp3.ConnectionSpec.COMPATIBLE_TLS`.
The test case fails if any [insecure TLS version](https://mas.owasp.org/MASTG/0x04f-Testing-Network-Communication/#recommended-tls-settings) is directly enabled, or if the app enabled any settings allowing the use of outdated TLS versions, such as `okhttp3.ConnectionSpec.COMPATIBLE_TLS`.
2 changes: 1 addition & 1 deletion tests-beta/android/MASVS-NETWORK/MASTG-TEST-0218.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,4 @@ The output shows the actually used TLS version.

## Evaluation

The test case fails if any ["insecure TLS version"](https://mas.owasp.org/MASTG/0x04f-Testing-Network-Communication/#recommended-tls-settings) is used.
The test case fails if any [insecure TLS version](https://mas.owasp.org/MASTG/0x04f-Testing-Network-Communication/#recommended-tls-settings) is used.

0 comments on commit 7d2c88f

Please sign in to comment.