[
https://issues.apache.org/jira/browse/NUTCH-3232?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18135847#comment-18135847
]
ASF GitHub Bot commented on NUTCH-3232:
---------------------------------------
handecelikkanat opened a new pull request, #986:
URL: https://github.com/apache/nutch/pull/986
Upgrade OkHttp from 5.4.0 to 5.5.1 (okhttp, okhttp-brotli, okhttp-zstd), and
update plugin.xml for the new jar versions (OkHttp 5.5.1, Okio 3.18.1).
See https://issues.apache.org/jira/browse/NUTCH-3232.
Tested with Java 21 and 17:
- ant clean runtime test
- OkHttpProtocolIT (3 tests, 0 failures), run locally with the classpath fix
from https://issues.apache.org/jira/browse/NUTCH-3233, because CI currently
skips this test
- bin/nutch parsechecker against https://nutch.apache.org/ (success, with
certificate checks on), and against a test server presenting one of the
blocked eMudhra certificates with http.tls.certificates.check=false
(rejected with 5.5.1, accepted with 5.4.0)
> Upgrade OkHttp to 5.5.1
> -----------------------
>
> Key: NUTCH-3232
> URL: https://issues.apache.org/jira/browse/NUTCH-3232
> Project: Nutch
> Issue Type: Improvement
> Components: plugin, protocol
> Affects Versions: 1.23
> Reporter: Hande Celikkanat
> Priority: Major
>
> Upgrade the OkHttp dependencies of protocol-okhttp (okhttp, okhttp-brotli,
> okhttp-zstd) from 5.4.0 to 5.5.1. This also upgrades Okio from 3.17.0 to
> 3.18.1.
> Notable changes since 5.4.0 (https://lysine.dev/okhttp/changelogs/changelog/):
> - 5.5.1 blocks 8 compromised eMudhra intermediate certificates
> (CVE-2026-111943).
> - 5.5.0 makes the default hostname verifier reject hosts that fail IP
> canonicalization.
> Note: OkHttp 5.5.1 applies the blocklist after hostname verification and
> independently of the trust manager, so protocol-okhttp rejects servers
> presenting one of the blocked certificates even when
> http.tls.certificates.check is false. The hostname verifier change in 5.5.0
> applies when http.tls.certificates.check is true, which is the default since
> NUTCH-3221.
> Behavior change, checked against a test server from the disclosure site that
> presents one of the blocked certificates, with certificate checks disabled
> (http.tls.certificates.check=false, the default before NUTCH-3221):
> {noformat}
> bin/nutch parsechecker -Dhttp.agent.name=test-crawler \
> -Dhttp.tls.certificates.check=false \
> -Dplugin.includes='protocol-okhttp|parse-(html|tika)'
> https://dv-g3b-emudhra.we-have-a-problem.com/
> {noformat}
> OkHttp 5.4.0 (master):
> {noformat}
> Status: success(1,0)
> {noformat}
> OkHttp 5.5.1 (this change):
> {noformat}
> Fetch failed with protocol status: exception(16), lastModified=0:
> javax.net.ssl.SSLPeerUnverifiedException: Hostname
> dv-g3b-emudhra.we-have-a-problem.com not verified (blocklisted by OkHttp)
> {noformat}
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
