Description
Description of the issue
Java code vulnerabilities that trust self-signed certificates for outbound HTTP requests are not detected by CodeQL. In other words, CWE-295 is not detected for self-signed certificates when the Apache HttpComponents HttpClient is used.
Apache HttpComponents is listed as a supported framework in the CodeQL documentation.
Code samples or links to source code
Refer to https://github.com/ebickle/codeql-security-selfsigned for a narrowly scoped example of the issue using HTTPClient 4.5 and TrustSelfSignedStrategy.
Some sample code is also included here:
KeyStore javaKeyStore = KeyStore.getInstance(KeyStore.getDefaultType());
SSLContext sslContext = SSLContexts.custom()
.loadTrustMaterial(null, new TrustSelfSignedStrategy())
.build();
HttpClientBuilder httpClientBuilder = HttpClientBuilder.create()
.setSSLContext(sslContext);
try (CloseableHttpClient httpClient = httpClientBuilder.build()) {
HttpGet request = new HttpGet("https://github.com/");
try (CloseableHttpResponse response = httpClient.execute(request)) {
System.out.println(response.getStatusLine().getReasonPhrase());
}
}
Based on a review of the java-queries and java-all qlpacks, it appears as though CodeQL isn't checking for any vulnerabilities where SSL certificate verification is disabled, except for the built-in Java SE platform classes. Apache HttpComponents is so broadly used that CodeQL should probably add additional checks targeting these libraries (and the various incompatible versions of it - e.g. v3.x, v4.x, v5.x).
There are a few different insecure configurations possible - the sample code above just covers self-signed certificates, but not completely disabling certificate validation or other common scenarios. The TrustSelfSignedStrategy was caught by our third-party scanning tool that we're deprecating, but not by CodeQL.