github / github/codeql

Java Code Scanning and Semmle Query Suites Allows for Trusting All Certificates in SSL Connection

Aberta
#4,852 3 comentários 0 reações 0 responsáveis Ver no GitHub
question
Linguagem predominante
CodeQL
Estrelas
10.1k
Forks
2.1k
Merge médio
2d 15h
PRs com merge (30d)
141

Descrição

CodeQL’s `java-code-scanning` or `java-lgtm-full` query suite will not flag empty `checkServerTrusted`, and `checkClientTrusted` which allows for Trusting All Certificates. Additionally, the experimental `UnsafeCert.ql` query (reference: https://github.com/github/codeql/blob/main/java/ql/src/experimental/Security/CWE/CWE-273/UnsafeCertTrust.ql) does not flag these:

Here is the evaluated example:
```java
import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.net.URLConnection;

import javax.net.ssl.*;
import java.net.URL;
import java.security.SecureRandom;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

public class BadSSL_Naive {

public static final String userURL = "https://self-signed.badssl.com";

private static X509TrustManager getX509TrustManager(){
return new X509TrustManager(){

@Override
public X509Certificate[] getAcceptedIssuers() {
// TODO Auto-generated method stub
return null;
}

@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
// TODO Auto-generated method stub

}

@Override
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
// TODO Auto-generated method stub

}
};
}

public static void main(final String[] args) {
try {

TrustManager[] trustAll = new TrustManager[]{
getX509TrustManager()
};

SSLContext context = SSLContext.getInstance("SSL");
context.init(null, trustAll, new SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(context.getSocketFactory());
// HttpsURLConnection.setDefaultHostnameVerifier(new DefaultHostnameVerifier());
final URLConnection conn = new URL(userURL).openConnection();

if (conn != null) {
try (BufferedReader br = new BufferedReader(new InputStreamReader(conn.getInputStream()))) {
String input;

while ((input = br.readLine()) != null) {
System.out.println(input);
}
}
}
} catch (Exception e) {
e.printStackTrace();
}
}
}
```

Guia de contribuição

Abrir o guia de contribuição

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.