[jpantonow]

Summary

I found that createRegularNodeOkHttpClient created its SSL context with the SSL selector while retaining its existing trust manager, socket factory, hostname verifier, and timeouts. SSL is not an accepted selector here; the allowed values are TLS, TLSv1.2, or TLSv1.3.

I changed the selector to TLS. This preserves protocol negotiation, including TLS 1.3, while leaving the trust manager, socket factory, hostname verifier, timeouts, and public factory name unchanged.

I found this while running the app under RVSec, a runtime-verification tool that watches the app's calls to the Java cryptography and TLS APIs and checks each sequence of calls against usage rules written in CrySL. SSLContextSpec is the rule this code did not satisfy.

How was this tested?

• No automated test was added in this change
• The patched module compiles successfully (:app:compileFdroidDebugSources); the full multi-module build was not completed in this environment

---

I'm an undergraduate Computer Engineering student at the University of Brasília (UnB); this contribution is part of a research project on the analysis of Android apps, and I'm happy to adjust it to match the project's conventions.

[mpretty-cyro]

Thanks for your PR @jpantonow, I took a look at the change and on Android, SSLContext.getInstance("SSL") and SSLContext.getInstance("TLS") resolve to the same implementation. Conscrypt registers "SSL" as an alias of "TLS" (https://github.com/google/conscrypt/blob/5bdcae0fe8aeb92009eba087969aed7f0ae0e167/common/src/main/java/org/conscrypt/OpenSSLProvider.java#L92-L94), and the negotiated protocol version is set by OkHttp's ConnectionSpec on each connection rather than by this string.

So this change doesn't alter runtime behaviour; it only satisfies the CrySL SSLContextSpec rule. We'll hold off merging for now since it doesn't change anything functionally.

[jpantonow]

Thanks for checking this, and for the Conscrypt link. You're right: on Android "SSL" is an alias of "TLS", so this change doesn't alter what gets negotiated. The only effect is that the code then states the protocol it actually uses, which keeps checkers like RVSec quiet and avoids confusion for readers. If you'd rather not take a change that is only cosmetic, feel free to close it. No problem at all.