Title: [Java] CWE-295 - Incorrect Hostname Verification by intrigus-lgtm · Pull Request #3581 · github/codeql · GitHub
Open Graph Title: [Java] CWE-295 - Incorrect Hostname Verification by intrigus-lgtm · Pull Request #3581 · github/codeql
X Title: [Java] CWE-295 - Incorrect Hostname Verification by intrigus-lgtm · Pull Request #3581 · github/codeql
Description: Hostname verification is an essential part of Transport Layer Security (TLS) and HTTPS. When a TLS connection is established there are two important steps: First, the chain of trust is verified that means it is checked whether the certificate has been issued by a trusted certificate authority. Second, the hostname (that is being connected to) needs to be verified against the certificate. That means it is checked whether the certificate is actually for the hostname. If the hostname is not verified an attacker could present any certificate with a valid chain of trust, but that is not issued for the hostname at all. Many posts tell developers that have problems with hostname verification to accept any certificate as valid in the case of a mismatch. These problems usually are configuration problems that should be fixed instead. Java verifies HTTPS hostname by default when using URL/HttpsUrlConnection. But when a protocol uses TLS (SSLEngine/SSLSocket) directly, the hostname is not verified by default. That's where the second part of my query (IncorrectHostnameVerifier.ql) comes into play. [This PR and PR description is WIP] [I've also noticed #3550, which seems to focus on the chain of trust vaildation]
Open Graph Description: Hostname verification is an essential part of Transport Layer Security (TLS) and HTTPS. When a TLS connection is established there are two important steps: First, the chain of trust is verified tha...
X Description: Hostname verification is an essential part of Transport Layer Security (TLS) and HTTPS. When a TLS connection is established there are two important steps: First, the chain of trust is verified tha...
Opengraph URL: https://github.com/github/codeql/pull/3581
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:6db285fb-dc96-727c-ec8b-03d7d720dbb8 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | D194:391DC1:1476195:1D9792B:6A4CE2A6 |
| html-safe-nonce | b03873088bcdbd4760d9f987540560363f597d8cb3dbd788bc2ec72476bb23ab |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJEMTk0OjM5MURDMToxNDc2MTk1OjFEOTc5MkI6NkE0Q0UyQTYiLCJ2aXNpdG9yX2lkIjoiMzcwNzc4NjU4MTk4NzA5MTExMSIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | faf6a28ab03e6a2e6aeef81c7423d8deb3f34b94206ea759730113ec6f755d90 |
| hovercard-subject-tag | pull_request:424114020 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/github/codeql/pull/3581/files |
| twitter:image | https://avatars.githubusercontent.com/u/60750685?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/60750685?s=400&v=4 |
| og:image:alt | Hostname verification is an essential part of Transport Layer Security (TLS) and HTTPS. When a TLS connection is established there are two important steps: First, the chain of trust is verified tha... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 299b43bca6e02ad35197ffeba30d2466846d5fb02ab96fbced5b5e6cec589fb8 |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/github/codeql git https://github.com/github/codeql.git |
| octolytics-dimension-user_id | 9919 |
| octolytics-dimension-user_login | github |
| octolytics-dimension-repository_id | 143040428 |
| octolytics-dimension-repository_nwo | github/codeql |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 143040428 |
| octolytics-dimension-repository_network_root_nwo | github/codeql |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | c5a57f04eeb310f57c73fd6d751d957e2ca27ed2 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width