kevinwhf
New Member
This is my problem ,, what can i do !! please help !! please >_<
Hello Google Play Developer,
Your app(s) listed at the end of this email have an unsafe implementation of the WebViewClient.onReceivedSslError handler. Specifically, the implementation ignores all SSL certificate validation errors, making your app vulnerable to man-in-the-middle attacks. An attacker could change the affected WebView's content, read transmitted data (such as login credentials), and execute code inside the app using JavaScript.
Please address this vulnerability as soon as possible and increment the version number of the upgraded APK. To properly handle SSL certificate validation, change your code to invoke SslErrorHandler.proceed() whenever the certificate presented by the server meets your expectations, and invoke SslErrorHandler.cancel() otherwise. If you are using a 3rd party library that’s responsible for this, please notify the 3rd party and work with them to address the issue.
For more information about the SSL error handler, please see our documentation in the Android Developers Help Center. For other technical questions, you can post to Stack Overflow and use the tags “android-security” and “SslErrorHandler.”
To confirm you’ve upgraded correctly, submit the updated version to the Developer Console and check back after five hours. If the app hasn’t been upgraded correctly, we will display a warning.
While these specific issues may not affect every app that uses WebView SSL, it’s best to stay up to date on all security patches. Apps with vulnerabilities that expose users to risk of compromise may be considered to be in violation of the Malicious Behavior policy and section4.4 of the Developer Distribution Agreement.
Apps must also comply with the Developer Distribution Agreement and Developer Program Policies. If you feel we have sent this warning in error, you can contact our policy support team through the Google Play Developer Help Center.
Regards,
The Google Play Team
©2016 Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043
Email preferences: You have received this mandatory email service announcement to update you about important changes to your Google Play Developer account.
Hello Google Play Developer,
Your app(s) listed at the end of this email have an unsafe implementation of the WebViewClient.onReceivedSslError handler. Specifically, the implementation ignores all SSL certificate validation errors, making your app vulnerable to man-in-the-middle attacks. An attacker could change the affected WebView's content, read transmitted data (such as login credentials), and execute code inside the app using JavaScript.
Please address this vulnerability as soon as possible and increment the version number of the upgraded APK. To properly handle SSL certificate validation, change your code to invoke SslErrorHandler.proceed() whenever the certificate presented by the server meets your expectations, and invoke SslErrorHandler.cancel() otherwise. If you are using a 3rd party library that’s responsible for this, please notify the 3rd party and work with them to address the issue.
For more information about the SSL error handler, please see our documentation in the Android Developers Help Center. For other technical questions, you can post to Stack Overflow and use the tags “android-security” and “SslErrorHandler.”
To confirm you’ve upgraded correctly, submit the updated version to the Developer Console and check back after five hours. If the app hasn’t been upgraded correctly, we will display a warning.
While these specific issues may not affect every app that uses WebView SSL, it’s best to stay up to date on all security patches. Apps with vulnerabilities that expose users to risk of compromise may be considered to be in violation of the Malicious Behavior policy and section4.4 of the Developer Distribution Agreement.
Apps must also comply with the Developer Distribution Agreement and Developer Program Policies. If you feel we have sent this warning in error, you can contact our policy support team through the Google Play Developer Help Center.
Regards,
The Google Play Team
©2016 Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043
Email preferences: You have received this mandatory email service announcement to update you about important changes to your Google Play Developer account.
