Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e11304a

Browse files
intrigusintrigus
committed
Java: Autoformat
1 parent b8f3e64 commit e11304a

2 files changed

Lines changed: 85 additions & 83 deletions

File tree

‎java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,11 @@
1010
*/
1111

1212
import java
13-
1413
import semmle.code.java.controlflow.Guards
1514
import semmle.code.java.dataflow.DataFlow
1615
import semmle.code.java.dataflow.FlowSources
1716
import semmle.code.java.dataflow.TaintTracking2
1817
import semmle.code.java.security.Encryption
19-
2018
import DataFlow::PathGraph
2119

2220
/**

‎java/ql/test/query-tests/security/CWE-297/UnsafeHostnameVerification.java‎

Lines changed: 85 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -5,95 +5,99 @@
55

66
public class UnsafeHostnameVerification {
77

8-
private static final boolean DISABLE_VERIFICATION = true;
8+
private static final boolean DISABLE_VERIFICATION = true;
99

10-
/**
11-
* Test the implementation of trusting all hostnames as an anonymous class
12-
*/
13-
public void testTrustAllHostnameOfAnonymousClass() {
14-
HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
15-
@Override
16-
public boolean verify(String hostname, SSLSession session) {
17-
return true; // BAD, always returns true
18-
}
19-
});
20-
}
10+
/**
11+
* Test the implementation of trusting all hostnames as an anonymous class
12+
*/
13+
public void testTrustAllHostnameOfAnonymousClass() {
14+
HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
15+
@Override
16+
public boolean verify(String hostname, SSLSession session) {
17+
return true; // BAD, always returns true
18+
}
19+
});
20+
}
2121

22-
/**
23-
* Test the implementation of trusting all hostnames as a lambda.
24-
*/
25-
public void testTrustAllHostnameLambda() {
26-
HttpsURLConnection.setDefaultHostnameVerifier((name, s) -> true); // BAD, always returns true
27-
}
22+
/**
23+
* Test the implementation of trusting all hostnames as a lambda.
24+
*/
25+
public void testTrustAllHostnameLambda() {
26+
HttpsURLConnection.setDefaultHostnameVerifier((name, s) -> true); // BAD, always returns true
27+
}
2828

29-
/**
30-
* Test an all-trusting hostname verifier that is guarded by a flag
31-
*/
32-
public void testGuardedByFlagTrustAllHostname() {
33-
if (DISABLE_VERIFICATION) {
34-
HttpsURLConnection.setDefaultHostnameVerifier(ALLOW_ALL_HOSTNAME_VERIFIER); // GOOD: The all-trusting
35-
// hostname verifier is guarded
36-
// by a feature flag
37-
}
38-
}
29+
/**
30+
* Test an all-trusting hostname verifier that is guarded by a flag
31+
*/
32+
public void testGuardedByFlagTrustAllHostname() {
33+
if (DISABLE_VERIFICATION) {
34+
HttpsURLConnection.setDefaultHostnameVerifier(ALLOW_ALL_HOSTNAME_VERIFIER); // GOOD: The all-trusting
35+
// hostname verifier is guarded
36+
// by a feature flag
37+
}
38+
}
3939

40-
public void testGuardedByFlagAccrossCalls() {
41-
if (DISABLE_VERIFICATION) {
42-
functionThatActuallyDisablesVerification();
43-
}
44-
}
40+
public void testGuardedByFlagAccrossCalls() {
41+
if (DISABLE_VERIFICATION) {
42+
functionThatActuallyDisablesVerification();
43+
}
44+
}
4545

46-
private void functionThatActuallyDisablesVerification() {
47-
HttpsURLConnection.setDefaultHostnameVerifier((name, s) -> true); // GOOD [but detected as BAD], because we only
48-
// check guards inside a function
49-
// and not accross function calls. This is considerer GOOD because the call to
50-
// `functionThatActuallyDisablesVerification` is guarded by a feature flag in
51-
// `testGuardedByFlagAccrossCalls`.
52-
// Although this is not ideal as another function could directly call
53-
// `functionThatActuallyDisablesVerification` WITHOUT checking the feature flag.
54-
}
46+
private void functionThatActuallyDisablesVerification() {
47+
HttpsURLConnection.setDefaultHostnameVerifier((name, s) -> true); // GOOD [but detected as BAD], because we only
48+
// check guards inside a function
49+
// and not accross function calls. This is considerer GOOD because the call to
50+
// `functionThatActuallyDisablesVerification` is guarded by a feature flag in
51+
// `testGuardedByFlagAccrossCalls`.
52+
// Although this is not ideal as another function could directly call
53+
// `functionThatActuallyDisablesVerification` WITHOUT checking the feature flag.
54+
}
5555

56-
public void testTrustAllHostnameDependingOnDerivedValue() {
57-
String enabled = System.getProperty("disableHostnameVerification");
58-
if (Boolean.parseBoolean(enabled)) {
59-
HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> true); // GOOD, because it depends on a feature
60-
// flag.
61-
}
62-
}
56+
public void testTrustAllHostnameDependingOnDerivedValue() {
57+
String enabled = System.getProperty("disableHostnameVerification");
58+
if (Boolean.parseBoolean(enabled)) {
59+
HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> true); // GOOD, because it depends on a
60+
// feature
61+
// flag.
62+
}
63+
}
6364

64-
public void testTrustAllHostnameWithExceptions() {
65-
HostnameVerifier verifier = new HostnameVerifier() {
66-
@Override
67-
public boolean verify(String hostname, SSLSession session) {
68-
verify(hostname, session.getPeerCertificates());
69-
return true; // GOOD [but detected as BAD]. The verification of the certificate is done in another method and
70-
// in the case of a mismatch, an `Exception` is thrown so the `return true` statement never gets executed.
71-
}
65+
public void testTrustAllHostnameWithExceptions() {
66+
HostnameVerifier verifier = new HostnameVerifier() {
67+
@Override
68+
public boolean verify(String hostname, SSLSession session) {
69+
verify(hostname, session.getPeerCertificates());
70+
return true; // GOOD [but detected as BAD]. The verification of the certificate is done in
71+
// another method and
72+
// in the case of a mismatch, an `Exception` is thrown so the `return true`
73+
// statement never gets executed.
74+
}
7275

73-
// Black-box method that properly verifies the certificate but throws an `Exception` in the case of a mismatch.
74-
private void verify(String hostname, Certificate[] certs){}
75-
};
76-
HttpsURLConnection.setDefaultHostnameVerifier(verifier);
77-
}
76+
// Black-box method that properly verifies the certificate but throws an
77+
// `Exception` in the case of a mismatch.
78+
private void verify(String hostname, Certificate[] certs) {
79+
}
80+
};
81+
HttpsURLConnection.setDefaultHostnameVerifier(verifier);
82+
}
7883

79-
/**
80-
* Test the implementation of trusting all hostnames as a variable
81-
*/
82-
public void testTrustAllHostnameOfVariable() {
83-
HostnameVerifier verifier = new HostnameVerifier() {
84-
@Override
85-
public boolean verify(String hostname, SSLSession session) {
86-
return true; // BAD, always returns true
87-
}
88-
};
89-
HttpsURLConnection.setDefaultHostnameVerifier(verifier);
90-
}
84+
/**
85+
* Test the implementation of trusting all hostnames as a variable
86+
*/
87+
public void testTrustAllHostnameOfVariable() {
88+
HostnameVerifier verifier = new HostnameVerifier() {
89+
@Override
90+
public boolean verify(String hostname, SSLSession session) {
91+
return true; // BAD, always returns true
92+
}
93+
};
94+
HttpsURLConnection.setDefaultHostnameVerifier(verifier);
95+
}
9196

92-
public static final HostnameVerifier ALLOW_ALL_HOSTNAME_VERIFIER = new HostnameVerifier() {
93-
@Override
94-
public boolean verify(String hostname, SSLSession session) {
95-
return true; // BAD, always returns true
96-
}
97-
};
97+
public static final HostnameVerifier ALLOW_ALL_HOSTNAME_VERIFIER = new HostnameVerifier() {
98+
@Override
99+
public boolean verify(String hostname, SSLSession session) {
100+
return true; // BAD, always returns true
101+
}
102+
};
98103
}
99-

0 commit comments

Comments
 (0)