[NUTCH-2786] TrustManager methods do not have certificate validation logic

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 1.16
• Component/s: plugin, protocol
• Assignee: Unassigned
• Reporter: Md Mahir Asef Kabir
• Created: 04/May/20 03:20
• Updated: 13/Mar/24 14:51
• Resolved: 19/Aug/22 12:51

Description

• Vulnerability Description: In “src/plugin/protocol-httpclient/src/java/org/apache/nutch/protocol/httpclient/DummyX509TrustManager.java” overridden TrustManager methods (i.e. checkClientTrusted and checkServerTrusted) do not have validation logic for certificates.

• Reason it’s vulnerable: It is vulnerable because DummyX509TrustManager implements X509TrustManager and it overrides the standard TrustManager methods (i.e. checkClientTrusted and checkServerTrusted) to do nothing but returning hard-coded true. Certificate validation is expected to be handled by these methods. Doing nothing means no verification.

• Suggested Fix: Adding necessary certificate verification logic in the overridden methods. This is an example code showing a format that can be used and modified appropriately to implement the certificate validation logic - https://paste.ubuntu.com/p/jWtH2yTNR8/ .

• Feedback: Please select any of the options down below to help us get an idea about how you felt about the suggestion -

1. Liked it and will make the suggested changes
2. Liked it but happy with the existing version
3. Didn’t find the suggestion helpful

Issue Links

• links to: GitHub Pull Request #524