swagger-api / swagger-api/swagger-codegen

Coverity giving High Impact Security Issue in API Client code for applySslSettings() method

Open
#9,911 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Mustache
Stars
17.8k
Forks
6k
PR merge metrics
No merged PRs in 30d

Description

Coverity is raising security issues for TrustManager in highlighted code below

Insecure SSL/TLS: bad TrustManager High impact security generatedChild/src/main/java/com/amdocs/oss/sfo/serviceordermanager/child/ApiClient.java ApiClient$2.checkServerTrusted
Insecure SSL/TLS: bad HostnameVerifier High impact security generated/src/main/java/io/swagger/client/ApiClient.java ApiClient$3.verify
Insecure SSL/TLS: bad TrustManager High impact security generated/src/main/java/io/swagger/client/ApiClient.java ApiClient$2.checkClientTrusted

TrustManager[] trustManagers = null;
HostnameVerifier hostnameVerifier = null;
if (!verifyingSsl) {
TrustManager trustAll = new X509TrustManager() {
@Override
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
@Override
public X509Certificate[] getAcceptedIssuers() { return null; }
};
SSLContext sslContext = SSLContext.getInstance("TLS");
trustManagers = new TrustManager[]{ trustAll };
hostnameVerifier = new HostnameVerifier() {
@Override
public boolean verify(String hostname, SSLSession session) { return true; }
};

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing applySslSettings() in generatedChild/src/main/java/com/amdocs/oss/sfo/serviceordermanager/child/ApiClient.java and generated/src/main/java/io/swagger/client/ApiClient.java. Review the reported checkClientTrusted, checkServerTrusted, and verify methods against the Coverity findings; done means the listed insecure SSL/TLS findings are addressed in the affected generated client code.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.