apache / apache/grails-core

ignoreSSLIssues function in grails RestBuilder

Open
#14,598 2 comments 0 reactions 0 assignees View on GitHub
relates-to: gorm
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

### Task List

- [x] Steps to reproduce provided
- [X] Stacktrace (if present) provided
- [X] Example that reproduces the problem uploaded to Github
- [X] Full description of the issue provided (see below)

### Steps to Reproduce

1. Clone the [example application](https://github.com/saqibahmed515/sslIssueDemo).
2. Start the project by executing `grails run-app` or `gradle bootRun`.
2. Call http://localhost:8080/demo/index

### Expected Behaviour

There should be a utility function to ignore any sort of SSL issues like there is for [HTTPBuilder](https://github.com/jgritman/httpbuilder/wiki/SSL#ignoresslissues). I trust the server and I want to bypass any SSL checks. So the request should get through. I don't want to add a certificate in the jre keytools as well.

### Actual Behaviour

The request throws an exception for the incorrect certificate. The stack trace follows:

#### Stacktrace
```bash
ERROR org.grails.web.errors.GrailsExceptionResolver - SunCertPathBuilderException occurred when processing request: [GET] /demo/index
unable to find valid certification path to requested target. Stacktrace follows:
java.lang.reflect.InvocationTargetException: null
at org.grails.core.DefaultGrailsControllerClass$ReflectionInvoker.invoke(DefaultGrailsControllerClass.java:210)
at org.grails.core.DefaultGrailsControllerClass.invoke(DefaultGrailsControllerClass.java:187)
at org.grails.web.mapping.mvc.UrlMappingsInfoHandlerAdapter.handle(UrlMappingsInfoHandlerAdapter.groovy:90)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:963)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:897)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970)
at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:861)
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
at org.springframework.boot.web.filter.ApplicationContextHeaderFilter.doFilterInternal(ApplicationContextHeaderFilter.java:55)
at org.grails.web.servlet.mvc.GrailsWebRequestFilter.doFilterInternal(GrailsWebRequestFilter.java:77)
at org.grails.web.filters.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:67)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://self-signed.badssl.com/": sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:633)
at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:588)
at org.springframework.web.client.RestTemplate.exchange(RestTemplate.java:507)
at grails.plugins.rest.client.RestBuilder.invokeRestTemplate(RestBuilder.groovy:310)
at grails.plugins.rest.client.RestBuilder.doRequestInternal(RestBuilder.groovy:274)
at grails.plugins.rest.client.RestBuilder.doRequestInternal(RestBuilder.groovy:262)
at grails.plugins.rest.client.RestBuilder.get(RestBuilder.groovy:107)
at sslisuedemo.DemoController.index(DemoController.groovy:9)
... 14 common frames omitted
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at org.springframework.http.client.SimpleBufferingClientHttpRequest.executeInternal(SimpleBufferingClientHttpRequest.java:78)
at org.springframework.http.client.AbstractBufferingClientHttpRequest.executeInternal(AbstractBufferingClientHttpRequest.java:48)
at org.springframework.http.client.AbstractClientHttpRequest.execute(AbstractClientHttpRequest.java:53)
at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:619)
... 21 common frames omitted
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
... 25 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
... 25 common frames omitted
```
### Environment Information

- **Operating System**: Windows 10
- **GORM Version:** 6.0
- **Grails Version (if using Grails):** 3.2.2
- **JDK Version:**
* java version "1.8.0_151"
* Java(TM) SE Runtime Environment (build 1.8.0_151-b12)
* Java HotSpot(TM) 64-Bit Server VM (build 25.151-b12, mixed mode)

### Example Application

Example application is given at https://github.com/saqibahmed515/sslIssueDemo.

Contributor guide

Open the contributing guide

Research direction

Start with grails.plugins.rest.client.RestBuilder.groovy, especially the request flow at lines 107, 262, 274, and 310, and review the example application's DemoController.groovy line 9. Compare the requested behavior with HTTPBuilder's documented ignoreSSLIssues function. Done means RestBuilder can make the demonstrated request to the self-signed endpoint without the certificate error.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy, java, spring
Domain
api, backend, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.