Question: Why is TLS certificate validation disabled globally?

[Kdroidwin]

Hi,

While reviewing the codebase, I noticed that MainActivity calls trustEveryone() during startup:

trustEveryone(); // Fix random certificate issue for BiliBili

The implementation appears to globally replace the default HostnameVerifier and X509TrustManager:

HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> true);
HttpsURLConnection.setDefaultSSLSocketFactory(context.getSocketFactory());

From my understanding, this effectively disables hostname verification and certificate validation for HttpsURLConnection, which could allow man-in-the-middle (MITM) attacks against HTTPS connections.

I was wondering about the rationale behind this implementation.

• Is this workaround required for a specific BiliBili endpoint or server configuration?
• Does the application fail to function correctly without it?
• Would it be possible to scope this workaround to only the affected host instead of changing the global defaults?

I'm asking because globally disabling TLS verification is generally considered a significant security risk, so I'd like to better understand the reasoning before proposing any changes.

Thanks!

[InfinityLoop1308]

Hi, this is intentional.

The setting only affects HttpsURLConnection, which is only used for media playback and downloads. Extraction, account-related requests, and other API requests use OkHttp with normal certificate validation.

It does not disable TLS, downgrade HTTPS, or send plaintext traffic. It only skips certificate and hostname validation so playback and downloads can continue when third-party CDN endpoints, particularly Bilibili CDNs, have broken certificate configurations. This does not create a meaningful security threat because these connections only carry media traffic, not account credentials or local app data.

Scoping it to a fixed hostname is not reliable because media CDN hosts can change. The current behavior is therefore an availability tradeoff for media traffic, not a global disabling of HTTPS security.