swagger-api / swagger-api/swagger-codegen
Coverity giving High Impact Security Issue in API Client code for applySslSettings() method
Nobody has claimed this yet.
- Dominant language
- Mustache
- Stars
- 17.8k
- Forks
- 6k
- PR merge metrics
- No merged PRs in 30d
Description
Coverity is raising security issues for TrustManager in highlighted code below
| Insecure SSL/TLS: bad TrustManager | High impact security | generatedChild/src/main/java/com/amdocs/oss/sfo/serviceordermanager/child/ApiClient.java | ApiClient$2.checkServerTrusted |
|---|---|---|---|
| Insecure SSL/TLS: bad HostnameVerifier | High impact security | generated/src/main/java/io/swagger/client/ApiClient.java | ApiClient$3.verify |
| Insecure SSL/TLS: bad TrustManager | High impact security | generated/src/main/java/io/swagger/client/ApiClient.java | ApiClient$2.checkClientTrusted |
TrustManager[] trustManagers = null;
HostnameVerifier hostnameVerifier = null;
if (!verifyingSsl) {
TrustManager trustAll = new X509TrustManager() {
@Override
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
@Override
public X509Certificate[] getAcceptedIssuers() { return null; }
};
SSLContext sslContext = SSLContext.getInstance("TLS");
trustManagers = new TrustManager[]{ trustAll };
hostnameVerifier = new HostnameVerifier() {
@Override
public boolean verify(String hostname, SSLSession session) { return true; }
};
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing applySslSettings() in generatedChild/src/main/java/com/amdocs/oss/sfo/serviceordermanager/child/ApiClient.java and generated/src/main/java/io/swagger/client/ApiClient.java. Review the reported checkClientTrusted, checkServerTrusted, and verify methods against the Coverity findings; done means the listed insecure SSL/TLS findings are addressed in the affected generated client code.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100