[JAVA][ApiClient.java]: Insecure SSL: Overly Broad Certificate Trust

Description

[JAVA][ApiClient.java]: Insecure SSL: Overly Broad Certificate Trust

A critical issue was discovered by Fortify in ApiClient.java generated by swagger-codegen:

An SSL/TLS connection is created using the default pre-loaded system Certificate Authorities (CAs), which may allow attackers to intercept encrypted communications by performing man-in-the-middle (MiTM) attacks using certificates signed with compromised root CAs.

Swagger-codegen version

2.3.1

Swagger declaration file content or url

                TrustManager trustAll = new X509TrustManager() {
                    @Override
                    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
                    @Override
                    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
                    @Override
                    public X509Certificate[] getAcceptedIssuers() { return null; }
                };

Command line used for generation

swagger-codegen generate

Steps to reproduce

Scan the generated code using Fortify.

Related issues/PRs

NA

Suggest a fix/enhancement

NA

The reported output is ApiClient.java, produced by the swagger-codegen generate command; start by locating the Java template or generation entry point that emits the shown TrustManager. Use the Fortify finding as the reproduction, then verify the generated client no longer triggers the overly broad certificate-trust finding.