Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 70b0703

Browse files
intrigusintrigus
committed
Java: Remove overlapping code
1 parent 3da1cb0 commit 70b0703

4 files changed

Lines changed: 6 additions & 101 deletions

File tree

‎java/ql/src/experimental/Security/CWE/CWE-273/UnsafeCertTrust.java‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,4 @@
11
public static void main(String[] args) {
2-
{
3-
HostnameVerifier verifier = new HostnameVerifier() {
4-
@Override
5-
public boolean verify(String hostname, SSLSession session) {
6-
try { //GOOD: verify the certificate
7-
Certificate[] certs = session.getPeerCertificates();
8-
X509Certificate x509 = (X509Certificate) certs[0];
9-
check(new String[]{host}, x509);
10-
return true;
11-
} catch (SSLException e) {
12-
return false;
13-
}
14-
}
15-
};
16-
HttpsURLConnection.setDefaultHostnameVerifier(verifier);
17-
}
18-
19-
{
20-
HostnameVerifier verifier = new HostnameVerifier() {
21-
@Override
22-
public boolean verify(String hostname, SSLSession session) {
23-
return true; // BAD: accept even if the hostname doesn't match
24-
}
25-
};
26-
HttpsURLConnection.setDefaultHostnameVerifier(verifier);
27-
}
282

293
{
304
X509TrustManager trustAllCertManager = new X509TrustManager() {

‎java/ql/src/experimental/Security/CWE/CWE-273/UnsafeCertTrust.qhelp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,18 @@
44
<qhelp>
55

66
<overview>
7-
<p>Java offers two mechanisms for SSL authentication - trust manager and hostname verifier. Trust manager validates the peer's certificate chain while hostname verification establishes that the hostname in the URL matches the hostname in the server's identification.</p>
7+
<p>Java offers two mechanisms for SSL authentication - trust manager and hostname verifier (not checked by this query). Trust manager validates the peer's certificate chain while hostname verification establishes that the hostname in the URL matches the hostname in the server's identification.</p>
88
<p>And when SSLSocket or SSLEngine is created without a valid parameter of setEndpointIdentificationAlgorithm, hostname verification is disabled by default.</p>
9-
<p>Unsafe implementation of the interface X509TrustManager, HostnameVerifier, and SSLSocket/SSLEngine ignores all SSL certificate validation errors when establishing an HTTPS connection, thereby making the app vulnerable to man-in-the-middle attacks.</p>
10-
<p>This query checks whether trust manager is set to trust all certificates, the hostname verifier is turned off, or setEndpointIdentificationAlgorithm is missing. The query also covers a special implementation com.rabbitmq.client.ConnectionFactory.</p>
9+
<p>Unsafe implementation of the interface X509TrustManager and SSLSocket/SSLEngine ignores all SSL certificate validation errors when establishing an HTTPS connection, thereby making the app vulnerable to man-in-the-middle attacks.</p>
10+
<p>This query checks whether trust manager is set to trust all certificates or setEndpointIdentificationAlgorithm is missing. The query also covers a special implementation com.rabbitmq.client.ConnectionFactory.</p>
1111
</overview>
1212

1313
<recommendation>
1414
<p>Validate SSL certificate in SSL authentication.</p>
1515
</recommendation>
1616

1717
<example>
18-
<p>The following two examples show two ways of configuring X509 trust cert manager and hostname verifier. In the 'BAD' case,
18+
<p>The following two examples show two ways of configuring X509 trust cert manager. In the 'BAD' case,
1919
no validation is performed thus any certificate is trusted. In the 'GOOD' case, the proper validation is performed.</p>
2020
<sample src="UnsafeCertTrust.java" />
2121
</example>

‎java/ql/src/experimental/Security/CWE/CWE-273/UnsafeCertTrust.ql‎

Lines changed: 2 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
2-
* @name Unsafe certificate trust and improper hostname verification
3-
* @description Unsafe implementation of the interface X509TrustManager, HostnameVerifier, and SSLSocket/SSLEngine ignores all SSL certificate validation errors when establishing an HTTPS connection, thereby making the app vulnerable to man-in-the-middle attacks.
2+
* @name Unsafe certificate trust
3+
* @description Unsafe implementation of the interface X509TrustManager and SSLSocket/SSLEngine ignores all SSL certificate validation errors when establishing an HTTPS connection, thereby making the app vulnerable to man-in-the-middle attacks.
44
* @kind problem
55
* @id java/unsafe-cert-trust
66
* @tags security
@@ -53,42 +53,6 @@ class X509TrustAllManagerInit extends MethodAccess {
5353
}
5454
}
5555

56-
/**
57-
* HostnameVerifier class that allows a certificate whose CN (Common Name) does not match the host name in the URL
58-
*/
59-
class TrustAllHostnameVerifier extends RefType {
60-
TrustAllHostnameVerifier() {
61-
this.getASupertype*() instanceof HostnameVerifier and
62-
exists(Method m, ReturnStmt rt |
63-
m.getDeclaringType() = this and
64-
m.hasName("verify") and
65-
rt.getEnclosingCallable() = m and
66-
rt.getResult().(BooleanLiteral).getBooleanValue() = true
67-
)
68-
}
69-
}
70-
71-
/**
72-
* The setDefaultHostnameVerifier method of HttpsURLConnection with the trust all configuration
73-
*/
74-
class TrustAllHostnameVerify extends MethodAccess {
75-
TrustAllHostnameVerify() {
76-
this.getMethod().hasName("setDefaultHostnameVerifier") and
77-
this.getMethod().getDeclaringType() instanceof HttpsURLConnection and //httpsURLConnection.setDefaultHostnameVerifier method
78-
(
79-
exists(NestedClass nc |
80-
nc.getASupertype*() instanceof TrustAllHostnameVerifier and
81-
this.getArgument(0).getType() = nc //Scenario of HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {...});
82-
)
83-
or
84-
exists(Variable v |
85-
this.getArgument(0).(VarAccess).getVariable() = v and
86-
v.getInitializer().getType() instanceof TrustAllHostnameVerifier //Scenario of HttpsURLConnection.setDefaultHostnameVerifier(verifier);
87-
)
88-
)
89-
}
90-
}
91-
9256
class SSLEngine extends RefType {
9357
SSLEngine() { this.hasQualifiedName("javax.net.ssl", "SSLEngine") }
9458
}
@@ -239,7 +203,6 @@ class RabbitMQEnableHostnameVerificationNotSet extends MethodAccess {
239203

240204
from MethodAccess aa
241205
where
242-
aa instanceof TrustAllHostnameVerify or
243206
aa instanceof X509TrustAllManagerInit or
244207
aa instanceof SSLEndpointIdentificationNotSet or
245208
aa instanceof RabbitMQEnableHostnameVerificationNotSet

‎java/ql/test/experimental/query-tests/security/CWE-273/UnsafeCertTrustTest.java‎

Lines changed: 0 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -48,31 +48,6 @@ public SSLSocketFactory testTrustAllCertManagerOfVariable() {
4848
}
4949
}
5050

51-
/**
52-
* Test the implementation of trusting all hostnames as an anonymous class
53-
*/
54-
public void testTrustAllHostnameOfAnonymousClass() {
55-
HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
56-
@Override
57-
public boolean verify(String hostname, SSLSession session) {
58-
return true; // Noncompliant
59-
}
60-
});
61-
}
62-
63-
/**
64-
* Test the implementation of trusting all hostnames as a variable
65-
*/
66-
public void testTrustAllHostnameOfVariable() {
67-
HostnameVerifier verifier = new HostnameVerifier() {
68-
@Override
69-
public boolean verify(String hostname, SSLSession session) {
70-
return true; // Noncompliant
71-
}
72-
};
73-
HttpsURLConnection.setDefaultHostnameVerifier(verifier);
74-
}
75-
7651
private static final X509TrustManager TRUST_ALL_CERTIFICATES = new X509TrustManager() {
7752
@Override
7853
public void checkClientTrusted(final X509Certificate[] chain, final String authType)
@@ -109,13 +84,6 @@ public X509Certificate[] getAcceptedIssuers() {
10984
}
11085
};
11186

112-
public static final HostnameVerifier ALLOW_ALL_HOSTNAME_VERIFIER = new HostnameVerifier() {
113-
@Override
114-
public boolean verify(String hostname, SSLSession session) {
115-
return true; // Noncompliant
116-
}
117-
};
118-
11987
/**
12088
* Test the endpoint identification of SSL engine is set to null
12189
*/

0 commit comments

Comments
 (0)