Java Code Scanning and Semmle Query Suites Allows for Trusting All Certificates in SSL Connection
- 主要語言
- CodeQL
- 星號
- 10.1k
- 分支
- 2.1k
- 平均合併
- 2 天 15 小時
- 30 天內合併 PR
- 141
描述
CodeQL’s `java-code-scanning` or `java-lgtm-full` query suite will not flag empty `checkServerTrusted`, and `checkClientTrusted` which allows for Trusting All Certificates. Additionally, the experimental `UnsafeCert.ql` query (reference: https://github.com/github/codeql/blob/main/java/ql/src/experimental/Security/CWE/CWE-273/UnsafeCertTrust.ql) does not flag these:
Here is the evaluated example:
```java
import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.net.URLConnection;
import javax.net.ssl.*;
import java.net.URL;
import java.security.SecureRandom;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
public class BadSSL_Naive {
public static final String userURL = "https://self-signed.badssl.com";
private static X509TrustManager getX509TrustManager(){
return new X509TrustManager(){
@Override
public X509Certificate[] getAcceptedIssuers() {
// TODO Auto-generated method stub
return null;
}
@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
// TODO Auto-generated method stub
}
@Override
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
// TODO Auto-generated method stub
}
};
}
public static void main(final String[] args) {
try {
TrustManager[] trustAll = new TrustManager[]{
getX509TrustManager()
};
SSLContext context = SSLContext.getInstance("SSL");
context.init(null, trustAll, new SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(context.getSocketFactory());
// HttpsURLConnection.setDefaultHostnameVerifier(new DefaultHostnameVerifier());
final URLConnection conn = new URL(userURL).openConnection();
if (conn != null) {
try (BufferedReader br = new BufferedReader(new InputStreamReader(conn.getInputStream()))) {
String input;
while ((input = br.readLine()) != null) {
System.out.println(input);
}
}
}
} catch (Exception e) {
e.printStackTrace();
}
}
}
```
貢獻指南
評估
這個 Issue 還沒有評估資料。