ref(transport): Pass DistrustedCertificates to HttpConnection

Inject the check through HttpConnection's constructor like AuthenticatorWrapper, so its tests can stub it instead of loading the real eMudhra certificate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: runningcode

sentry-android-distribution/src/main/java/io/sentry/android/distribution/DistributionHttpClient.kt

@@ -95,7 +95,7 @@ internal class DistributionHttpClient(private val options: SentryOptions) {
       }
 
       connection.connect()
-      DistrustedCertificates.verify(connection)
+      DistrustedCertificates.getInstance().verify(connection)
 
       val responseCode = connection.responseCode
       val responseBody = readResponse(connection)

sentry/api/sentry.api

@@ -7765,7 +7765,8 @@ public final class io/sentry/transport/CurrentDateProvider : io/sentry/transport
 }
 
 public final class io/sentry/transport/DistrustedCertificates {
-	public static fun verify (Ljava/net/HttpURLConnection;)V
+	public static fun getInstance ()Lio/sentry/transport/DistrustedCertificates;
+	public fun verify (Ljava/net/HttpURLConnection;)V
 }
 
 public abstract interface class io/sentry/transport/ICurrentDateProvider {

sentry/src/main/java/io/sentry/transport/DistrustedCertificates.java

@@ -47,6 +47,12 @@ public final class DistrustedCertificates {
               "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105",
               "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6"));
 
+  private static final DistrustedCertificates instance = new DistrustedCertificates();
+
+  public static @NotNull DistrustedCertificates getInstance() {
+    return instance;
+  }
+
   private DistrustedCertificates() {}
 
   /**
@@ -57,7 +63,7 @@ private DistrustedCertificates() {}
    * do this check, because the JVM's {@link HttpsURLConnection} only calls it when its own hostname
    * check fails.
    */
-  public static void verify(final @NotNull HttpURLConnection connection)
+  public void verify(final @NotNull HttpURLConnection connection)
       throws SSLPeerUnverifiedException {
     if (!(connection instanceof HttpsURLConnection)) {
       return;

sentry/src/main/java/io/sentry/transport/HttpConnection.java

@@ -33,6 +33,7 @@ final class HttpConnection {
   private final @NotNull RequestDetails requestDetails;
   private final @NotNull SentryOptions options;
   private final @NotNull RateLimiter rateLimiter;
+  private final @NotNull DistrustedCertificates distrustedCertificates;
 
   /**
    * Constructs a new HTTP transport instance. Notably, the provided {@code requestUpdater} must set
@@ -47,17 +48,24 @@ public HttpConnection(
       final @NotNull SentryOptions options,
       final @NotNull RequestDetails requestDetails,
       final @NotNull RateLimiter rateLimiter) {
-    this(options, requestDetails, AuthenticatorWrapper.getInstance(), rateLimiter);
+    this(
+        options,
+        requestDetails,
+        AuthenticatorWrapper.getInstance(),
+        rateLimiter,
+        DistrustedCertificates.getInstance());
   }
 
   HttpConnection(
       final @NotNull SentryOptions options,
       final @NotNull RequestDetails requestDetails,
       final @NotNull AuthenticatorWrapper authenticatorWrapper,
-      final @NotNull RateLimiter rateLimiter) {
+      final @NotNull RateLimiter rateLimiter,
+      final @NotNull DistrustedCertificates distrustedCertificates) {
     this.requestDetails = requestDetails;
     this.options = options;
     this.rateLimiter = rateLimiter;
+    this.distrustedCertificates = distrustedCertificates;
 
     this.proxy = resolveProxy(options.getProxy());
 
@@ -143,7 +151,7 @@ HttpURLConnection open() throws IOException {
     }
 
     connection.connect();
-    DistrustedCertificates.verify(connection);
+    distrustedCertificates.verify(connection);
     return connection;
   }
 

sentry/src/test/java/io/sentry/transport/DistrustedCertificatesTest.kt

@@ -16,13 +16,14 @@ import org.mockito.kotlin.whenever
 class DistrustedCertificatesTest {
 
   private val connection = mock<HttpsURLConnection>()
+  private val sut = DistrustedCertificates.getInstance()
 
   @Test
   fun `throws and disconnects when the chain contains a distrusted certificate`() {
     val certificates = arrayOf(trustedCertificate(), distrustedCertificate())
     whenever(connection.serverCertificates).thenReturn(certificates)
 
-    assertFailsWith<SSLPeerUnverifiedException> { DistrustedCertificates.verify(connection) }
+    assertFailsWith<SSLPeerUnverifiedException> { sut.verify(connection) }
 
     verify(connection).disconnect()
   }
@@ -32,7 +33,7 @@ class DistrustedCertificatesTest {
     val certificates = arrayOf(trustedCertificate())
     whenever(connection.serverCertificates).thenReturn(certificates)
 
-    DistrustedCertificates.verify(connection)
+    sut.verify(connection)
 
     verify(connection, never()).disconnect()
   }
@@ -41,7 +42,7 @@ class DistrustedCertificatesTest {
   fun `accepts a connection without server certificates`() {
     whenever(connection.serverCertificates).thenReturn(null)
 
-    DistrustedCertificates.verify(connection)
+    sut.verify(connection)
 
     verify(connection, never()).disconnect()
   }
@@ -50,26 +51,22 @@ class DistrustedCertificatesTest {
   fun `ignores plain HTTP connections`() {
     val connection = mock<HttpURLConnection>()
 
-    DistrustedCertificates.verify(connection)
+    sut.verify(connection)
 
     verify(connection, never()).disconnect()
   }
 
-  companion object {
-    /** EM DV TLS CA - G3B as cross-signed by Sectigo's AAA Certificate Services root. */
-    fun distrustedCertificate(): Certificate =
-      DistrustedCertificatesTest::class
-        .java
-        .classLoader!!
-        .getResourceAsStream("emudhra-em-dv-tls-ca-g3b.pem")!!
-        .use { CertificateFactory.getInstance("X.509").generateCertificate(it) }
-
-    private fun trustedCertificate(): Certificate {
-      val publicKey = mock<PublicKey>()
-      whenever(publicKey.encoded).thenReturn(byteArrayOf(1, 2, 3))
-      val certificate = mock<Certificate>()
-      whenever(certificate.publicKey).thenReturn(publicKey)
-      return certificate
+  /** EM DV TLS CA - G3B as cross-signed by Sectigo's AAA Certificate Services root. */
+  private fun distrustedCertificate(): Certificate =
+    javaClass.classLoader!!.getResourceAsStream("emudhra-em-dv-tls-ca-g3b.pem")!!.use {
+      CertificateFactory.getInstance("X.509").generateCertificate(it)
     }
+
+  private fun trustedCertificate(): Certificate {
+    val publicKey = mock<PublicKey>()
+    whenever(publicKey.encoded).thenReturn(byteArrayOf(1, 2, 3))
+    val certificate = mock<Certificate>()
+    whenever(certificate.publicKey).thenReturn(publicKey)
+    return certificate
   }
 }

sentry/src/test/java/io/sentry/transport/HttpConnectionTest.kt

@@ -27,7 +27,9 @@ import kotlin.test.assertNull
 import kotlin.test.assertTrue
 import org.mockito.kotlin.any
 import org.mockito.kotlin.check
+import org.mockito.kotlin.doThrow
 import org.mockito.kotlin.eq
+import org.mockito.kotlin.inOrder
 import org.mockito.kotlin.mock
 import org.mockito.kotlin.never
 import org.mockito.kotlin.verify
@@ -41,6 +43,7 @@ class HttpConnectionTest {
     val currentDateProvider = mock<ICurrentDateProvider>()
     val authenticatorWrapper = mock<AuthenticatorWrapper>()
     val rateLimiter = mock<RateLimiter>()
+    val distrustedCertificates = mock<DistrustedCertificates>()
     var sslSocketFactory: SSLSocketFactory? = null
     val requestDetails = mock<RequestDetails>()
     val socketTagger = mock<ISocketTagger>()
@@ -63,7 +66,13 @@ class HttpConnectionTest {
       options.sslSocketFactory = sslSocketFactory
       options.setSocketTagger(socketTagger)
 
-      return HttpConnection(options, requestDetails, authenticatorWrapper, rateLimiter)
+      return HttpConnection(
+        options,
+        requestDetails,
+        authenticatorWrapper,
+        rateLimiter,
+        distrustedCertificates,
+      )
     }
   }
 
@@ -170,16 +179,28 @@ class HttpConnectionTest {
     verify(fixture.connection, never()).sslSocketFactory = any()
   }
 
+  @Test
+  fun `verifies the server certificates after connecting and before writing the envelope`() {
+    val transport = fixture.getSUT()
+
+    transport.send(createEnvelope())
+
+    val order = inOrder(fixture.connection, fixture.distrustedCertificates)
+    order.verify(fixture.connection).connect()
+    order.verify(fixture.distrustedCertificates).verify(fixture.connection)
+    order.verify(fixture.connection).outputStream
+  }
+
   @Test
   fun `does not send the envelope when the server presents a distrusted certificate`() {
-    whenever(fixture.connection.serverCertificates)
-      .thenReturn(arrayOf(DistrustedCertificatesTest.distrustedCertificate()))
+    doThrow(SSLPeerUnverifiedException("distrusted"))
+      .whenever(fixture.distrustedCertificates)
+      .verify(fixture.connection)
     val transport = fixture.getSUT()
 
     assertFailsWith<SSLPeerUnverifiedException> { transport.send(createEnvelope()) }
 
     verify(fixture.connection, never()).outputStream
-    verify(fixture.connection).disconnect()
   }
 
   @Test