{"record":{"id":"becf25f3cf38ee16","repo":"Tencent/VasSonic","slug":"attempt-to-verify-non-ssl-socket","errorCode":null,"errorMessage":"Attempt to verify non-SSL socket","messagePattern":"Attempt to verify non-SSL socket","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"sonic-android/sdk/src/main/java/com/tencent/sonic/sdk/SonicSniSSLSocketFactory.java","lineNumber":177,"sourceCode":"    /**\n     * Verify the hostname of the certificate used by the other end of a\n     * connected socket.  You MUST call this if you did not supply a hostname\n     * to {@link #createSocket()}.  It is harmless to call this method\n     * redundantly if the hostname has already been verified.\n     *\n     * <p>Wildcard certificates are allowed to verify any matching hostname,\n     * so \"foo.bar.example.com\" is verified if the peer has a certificate\n     * for \"*.example.com\".\n     *\n     * @param socket An SSL socket which has been connected to a server\n     * @param hostname The expected hostname of the remote server\n     * @throws IOException if something goes wrong handshaking with the server\n     * @throws SSLPeerUnverifiedException if the server cannot prove its identity\n     *\n     */\n    public static void verifyHostname(Socket socket, String hostname) throws IOException {\n        if (!(socket instanceof SSLSocket)) {\n            throw new IllegalArgumentException(\"Attempt to verify non-SSL socket\");\n        }\n\n        // The code at the start of OpenSSLSocketImpl.startHandshake()\n        // ensures that the call is idempotent, so we can safely call it.\n        SSLSocket ssl = (SSLSocket) socket;\n        ssl.startHandshake();\n\n        SSLSession session = ssl.getSession();\n        if (session == null) {\n            throw new SSLException(\"Cannot verify SSL socket without session\");\n        }\n\n        if (!HttpsURLConnection.getDefaultHostnameVerifier().verify(hostname, session)) {\n            SonicUtils.log(TAG, Log.ERROR, \"sonic SSL error:Cannot verify hostname\" + hostname + \")!\");\n            throw new SSLPeerUnverifiedException(\"Cannot verify hostname: \" + hostname);\n        }\n    }\n}","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/Tencent/VasSonic/blob/59936beff656d4b5718ff6444d6c5e001a2c5231/sonic-android/sdk/src/main/java/com/tencent/sonic/sdk/SonicSniSSLSocketFactory.java#L159-L195","documentation":"SonicSniSSLSocketFactory.verifyHostname() performs SNI-safe hostname verification by starting the TLS handshake itself. It throws IllegalArgumentException when the socket passed is not an SSLSocket, since verification is meaningless for plain sockets.","triggerScenarios":"Calling verifyHostname(socket, hostname) with a plain socket, typically when createSocket() on the factory returned a non-SSL socket because the underlying SSLSocketFactory could not create an SSL connection (e.g. plain-HTTP connection reused through the factory).","commonSituations":"Wiring the SNI socket factory into a connection that falls back to plain HTTP; a custom SSLSocketFactory delegate returning non-SSL sockets; using the factory with an http:// URL by mistake.","solutions":["Ensure the factory is only used for HTTPS connections; don't apply it to plain sockets","Check that the delegate SSLSocketFactory creates real SSL sockets (not a mock/fallback)","Guard call sites: only call verifyHostname on sockets where socket instanceof SSLSocket","If supporting both schemes, branch: verify hostname only when the scheme is https"],"exampleFix":"// before\nSonicSniSSLSocketFactory.verifyHostname(socket, host); // throws for plain sockets\n// after\nif (socket instanceof SSLSocket) {\n  SonicSniSSLSocketFactory.verifyHostname(socket, host);\n}","handlingStrategy":"type-guard","validationCode":"if (!(socket instanceof SSLSocket)) {\n  throw new IllegalArgumentException(\"verifyHostname requires an SSLSocket\");\n}","typeGuard":"// Java\nstatic boolean isSsl(Socket s) {\n  return s instanceof SSLSocket;\n}","tryCatchPattern":"try {\n  SonicSniSSLSocketFactory.verifyHostname(socket, host);\n} catch (IllegalArgumentException e) {\n  // socket was not SSL: skip verification or fail the connection\n}","preventionTips":["Use the SNI factory only for HTTPS connections","Verify custom socket-factory delegates actually produce SSLSockets","Assert the scheme is https before hostname verification"],"tags":["ssl","android","tls"],"backgroundTag":"invalid-argument-value","analyzedSha":"59936beff656d4b5718ff6444d6c5e001a2c5231","analyzedAt":"2026-09-08T10:27:05.448Z","contentChangedAt":"2026-09-08T10:27:05.448Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}