Hande Celikkanat created NUTCH-3232:
---------------------------------------
Summary: Upgrade OkHttp to 5.5.1
Key: NUTCH-3232
URL: https://issues.apache.org/jira/browse/NUTCH-3232
Project: Nutch
Issue Type: Improvement
Components: plugin, protocol
Affects Versions: 1.23
Reporter: Hande Celikkanat
Upgrade the OkHttp dependencies of protocol-okhttp (okhttp, okhttp-brotli,
okhttp-zstd) from 5.4.0 to 5.5.1. This also upgrades Okio from 3.17.0 to 3.18.1.
Notable changes since 5.4.0 (https://lysine.dev/okhttp/changelogs/changelog/):
- 5.5.1 blocks 8 compromised eMudhra intermediate certificates
(CVE-2026-111943).
- 5.5.0 makes the default hostname verifier reject hosts that fail IP
canonicalization.
Note: OkHttp 5.5.1 applies the blocklist after hostname verification and
independently of the trust manager, so protocol-okhttp rejects servers
presenting one of the blocked certificates even when
http.tls.certificates.check is false. The hostname verifier change in 5.5.0
applies when http.tls.certificates.check is true, which is the default since
NUTCH-3221.
Behavior change, checked against a test server from the disclosure site that
presents one of the blocked certificates, with certificate checks disabled
(http.tls.certificates.check=false, the default before NUTCH-3221):
{noformat}
bin/nutch parsechecker -Dhttp.agent.name=test-crawler \
-Dhttp.tls.certificates.check=false \
-Dplugin.includes='protocol-okhttp|parse-(html|tika)'
https://dv-g3b-emudhra.we-have-a-problem.com/
{noformat}
OkHttp 5.4.0 (master):
{noformat}
Status: success(1,0)
{noformat}
OkHttp 5.5.1 (this change):
{noformat}
Fetch failed with protocol status: exception(16), lastModified=0:
javax.net.ssl.SSLPeerUnverifiedException: Hostname
dv-g3b-emudhra.we-have-a-problem.com not verified (blocklisted by OkHttp)
{noformat}
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
