This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 0b0018dc5f Improved: Remove the accept-all hostname verifier option
from SSLUtil and HttpClient (OFBIZ-13634)
0b0018dc5f is described below
commit 0b0018dc5ffece6ceceb47473efa83c6c33378dd
Author: Mridul Pathak <[email protected]>
AuthorDate: Sat Oct 3 12:04:54 2026 +0530
Improved: Remove the accept-all hostname verifier option from SSLUtil and
HttpClient (OFBIZ-13634)
SSLUtil.getHostCertNoCheck() and HttpClient.setHostVerificationLevel(int)
allowed turning off host name verification for any HTTPS connection made
through HttpClient and URLConnector, and were only used by two tests. They are
removed: HttpClient now takes a HostnameVerifier (null means the default
verification), which URLConnector passes to the connection, and the tests
supply a verifier that accepts only localhost.
---
.../org/apache/ofbiz/base/util/HttpClient.java | 20 +++++++------
.../java/org/apache/ofbiz/base/util/SSLUtil.java | 21 --------------
.../org/apache/ofbiz/base/util/URLConnector.java | 33 +++++++++++++---------
.../ofbiz/widget/test/WidgetMacroLibraryTests.java | 4 +--
4 files changed, 32 insertions(+), 46 deletions(-)
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/HttpClient.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/HttpClient.java
index de3654b8ec..201dd5ddf0 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/HttpClient.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/HttpClient.java
@@ -34,6 +34,8 @@ import java.util.List;
import java.util.Locale;
import java.util.Map;
+import javax.net.ssl.HostnameVerifier;
+
/**
* Send HTTP GET/POST requests.
* The main problem with current implementation is that it does not handle
connections release. You must rely on the OS to release them (timeout).
@@ -43,7 +45,7 @@ public class HttpClient {
private static final String MODULE = HttpClient.class.getName();
- private int hostVerification = SSLUtil.getHostCertNormalCheck();
+ private HostnameVerifier hostnameVerifier = null;
private int timeout = 30000;
private boolean debug = false;
private boolean lineFeed = true;
@@ -220,14 +222,14 @@ public class HttpClient {
return this.clientCertAlias;
}
- /** Sets the server hostname verification level */
- public void setHostVerificationLevel(int level) {
- this.hostVerification = level;
+ /** Sets the verifier used to check the server host name of HTTPS
connections; {@code null} (the default) means the default verification */
+ public void setHostnameVerifier(HostnameVerifier hostnameVerifier) {
+ this.hostnameVerifier = hostnameVerifier;
}
- /** Returns the current server hostname verification level */
- public int getHostVerificationLevel() {
- return this.hostVerification;
+ /** Returns the verifier used to check the server host name of HTTPS
connections, or {@code null} for the default verification */
+ public HostnameVerifier getHostnameVerifier() {
+ return this.hostnameVerifier;
}
/** Allow untrusted server certificates */
@@ -468,9 +470,9 @@ public class HttpClient {
try {
requestUrl = UtilURL.fromUrlString(url);
if (overrideTrust) {
- con = URLConnector.openUntrustedConnection(requestUrl,
timeout, clientCertAlias, hostVerification);
+ con = URLConnector.openUntrustedConnection(requestUrl,
timeout, clientCertAlias, hostnameVerifier);
} else {
- con = URLConnector.openConnection(requestUrl, timeout,
clientCertAlias, hostVerification);
+ con = URLConnector.openConnection(requestUrl, timeout,
clientCertAlias, hostnameVerifier);
}
if (Debug.verboseOn() || debug) {
Debug.logVerbose("Connection opened to : " +
requestUrl.toExternalForm(), MODULE);
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/SSLUtil.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/SSLUtil.java
index 497b1718e3..8b6990118e 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/SSLUtil.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/SSLUtil.java
@@ -28,7 +28,6 @@ import java.util.Arrays;
import java.util.LinkedList;
import java.util.List;
-import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
@@ -49,9 +48,6 @@ public final class SSLUtil {
private static final String MODULE = SSLUtil.class.getName();
- private static final int HOSTCERT_NO_CHECK = 0;
- private static final int HOSTCERT_NORMAL_CHECK = 2;
-
private static boolean loadedProps = false;
private static final SecureRandom SECURE_RANDOM = new SecureRandom();
@@ -88,14 +84,6 @@ public final class SSLUtil {
}
- public static int getHostCertNoCheck() {
- return HOSTCERT_NO_CHECK;
- }
-
- static int getHostCertNormalCheck() {
- return HOSTCERT_NORMAL_CHECK;
- }
-
public static boolean isClientTrusted(X509Certificate[] chain, String
authType) {
TrustManager[] mgrs = new TrustManager[0];
try {
@@ -245,15 +233,6 @@ public final class SSLUtil {
return getSSLContext(alias, false).getServerSocketFactory();
}
- public static HostnameVerifier getHostnameVerifier(int level) {
- switch (level) {
- case HOSTCERT_NO_CHECK:
- return (hostname, session) -> true;
- default:
- return null;
- }
- }
-
public static void loadJsseProperties() {
loadJsseProperties(false);
}
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/URLConnector.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/URLConnector.java
index cdf362ecb2..c7a4a26e3c 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/URLConnector.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/URLConnector.java
@@ -42,14 +42,14 @@ public class URLConnector {
private String clientCertAlias = null;
private boolean timedOut = false;
private boolean trustAnyCert = false;
- private int hostCertLevel = 2;
+ private HostnameVerifier hostnameVerifier = null;
protected URLConnector() { }
- private URLConnector(URL url, String clientCertAlias, int hostCertLevel,
boolean trustAnyCert) {
+ private URLConnector(URL url, String clientCertAlias, HostnameVerifier
hostnameVerifier, boolean trustAnyCert) {
this.clientCertAlias = clientCertAlias;
this.url = url;
this.trustAnyCert = trustAnyCert;
- this.hostCertLevel = hostCertLevel;
+ this.hostnameVerifier = hostnameVerifier;
}
/**
@@ -86,15 +86,20 @@ public class URLConnector {
}
public static URLConnection openConnection(URL url, int timeout) throws
IOException {
- return openConnection(url, timeout, null,
SSLUtil.getHostCertNormalCheck());
+ return openConnection(url, timeout, null, null);
}
public static URLConnection openConnection(URL url, String
clientCertAlias) throws IOException {
- return openConnection(url, 30000, clientCertAlias,
SSLUtil.getHostCertNormalCheck());
+ return openConnection(url, 30000, clientCertAlias, null);
}
- public static URLConnection openConnection(URL url, int timeout, String
clientCertAlias, int hostCertLevel) throws IOException {
- URLConnector uc = new URLConnector(url, clientCertAlias,
hostCertLevel, false);
+ /**
+ * Open a connection, trusting only valid certificates.
+ * @param hostnameVerifier the host name verifier to use for HTTPS, or
{@code null} for the default verification
+ */
+ public static URLConnection openConnection(URL url, int timeout, String
clientCertAlias, HostnameVerifier hostnameVerifier)
+ throws IOException {
+ URLConnector uc = new URLConnector(url, clientCertAlias,
hostnameVerifier, false);
return uc.openConnection(timeout);
}
@@ -104,15 +109,16 @@ public class URLConnector {
}
public static URLConnection openUntrustedConnection(URL url, int timeout)
throws IOException {
- return openUntrustedConnection(url, timeout, null,
SSLUtil.getHostCertNormalCheck());
+ return openUntrustedConnection(url, timeout, null, null);
}
public static URLConnection openUntrustedConnection(URL url, String
clientCertAlias) throws IOException {
- return openUntrustedConnection(url, 30000, clientCertAlias,
SSLUtil.getHostCertNormalCheck());
+ return openUntrustedConnection(url, 30000, clientCertAlias, null);
}
- static URLConnection openUntrustedConnection(URL url, int timeout, String
clientCertAlias, int hostCertLevel) throws IOException {
- URLConnector uc = new URLConnector(url, clientCertAlias,
hostCertLevel, true);
+ static URLConnection openUntrustedConnection(URL url, int timeout, String
clientCertAlias, HostnameVerifier hostnameVerifier)
+ throws IOException {
+ URLConnector uc = new URLConnector(url, clientCertAlias,
hostnameVerifier, true);
return uc.openConnection(timeout);
}
@@ -128,9 +134,8 @@ public class URLConnector {
HttpsURLConnection scon = (HttpsURLConnection) con;
try {
scon.setSSLSocketFactory(SSLUtil.getSSLSocketFactory(clientCertAlias,
trustAnyCert));
- HostnameVerifier hv =
SSLUtil.getHostnameVerifier(hostCertLevel);
- if (hv != null) {
- scon.setHostnameVerifier(hv);
+ if (hostnameVerifier != null) {
+ scon.setHostnameVerifier(hostnameVerifier);
}
} catch (GeneralSecurityException | GenericConfigException
e) {
Debug.logError(e, MODULE);
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/test/WidgetMacroLibraryTests.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/test/WidgetMacroLibraryTests.java
index 2f0e8fac20..38bd807309 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/test/WidgetMacroLibraryTests.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/test/WidgetMacroLibraryTests.java
@@ -24,7 +24,6 @@ import java.io.InputStream;
import org.apache.ofbiz.base.start.Start;
import org.apache.ofbiz.base.util.HttpClient;
import org.apache.ofbiz.base.util.HttpClientException;
-import org.apache.ofbiz.base.util.SSLUtil;
import org.apache.ofbiz.service.testtools.OFBizTestCase;
import org.apache.tika.metadata.Metadata;
import org.apache.tika.parser.ParseContext;
@@ -48,7 +47,8 @@ public class WidgetMacroLibraryTests extends OFBizTestCase {
HttpClient http = new HttpClient();
http.followRedirects(true);
http.setAllowUntrusted(true);
- http.setHostVerificationLevel(SSLUtil.getHostCertNoCheck());
+ // the test certificate is not issued for localhost
+ http.setHostnameVerifier((hostname, session) ->
"localhost".equals(hostname));
return http;
}
