github / github/codeql

Java Code Scanning and Semmle Query Suites Allows for Trusting All Certificates in SSL Connection

Abierto
#4,852 3 comentarios 0 reacciones 0 asignados Ver en GitHub
question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

CodeQL’s `java-code-scanning` or `java-lgtm-full` query suite will not flag empty `checkServerTrusted`, and `checkClientTrusted` which allows for Trusting All Certificates. Additionally, the experimental `UnsafeCert.ql` query (reference: https://github.com/github/codeql/blob/main/java/ql/src/experimental/Security/CWE/CWE-273/UnsafeCertTrust.ql) does not flag these:

Here is the evaluated example:
```java
import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.net.URLConnection;

import javax.net.ssl.*;
import java.net.URL;
import java.security.SecureRandom;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

public class BadSSL_Naive {

public static final String userURL = "https://self-signed.badssl.com";

private static X509TrustManager getX509TrustManager(){
return new X509TrustManager(){

@Override
public X509Certificate[] getAcceptedIssuers() {
// TODO Auto-generated method stub
return null;
}

@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
// TODO Auto-generated method stub

}

@Override
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
// TODO Auto-generated method stub

}
};
}

public static void main(final String[] args) {
try {

TrustManager[] trustAll = new TrustManager[]{
getX509TrustManager()
};

SSLContext context = SSLContext.getInstance("SSL");
context.init(null, trustAll, new SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(context.getSocketFactory());
// HttpsURLConnection.setDefaultHostnameVerifier(new DefaultHostnameVerifier());
final URLConnection conn = new URL(userURL).openConnection();

if (conn != null) {
try (BufferedReader br = new BufferedReader(new InputStreamReader(conn.getInputStream()))) {
String input;

while ((input = br.readLine()) != null) {
System.out.println(input);
}
}
}
} catch (Exception e) {
e.printStackTrace();
}
}
}
```

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.