diff --git a/rules/java/lang/ssl_hostname_verifier.yml b/rules/java/lang/ssl_hostname_verifier.yml index 7db951d30..efb74a8cb 100644 --- a/rules/java/lang/ssl_hostname_verifier.yml +++ b/rules/java/lang/ssl_hostname_verifier.yml @@ -68,9 +68,34 @@ patterns: regex: \A(java\.security\.cert\.)?X509Certificate\z - variable: NULL_X509_CERTIFICATE detection: ssl_hostname_verifier_null_x509_cert + - pattern: | + class $<...>$<_> implements $ { + $$<...>X509Certificate[] getAcceptedIssuers() { + return $; + } + }; + filters: + - variable: X509_TRUST_MANAGER + regex: \A(javax\.net\.ssl\.)?X509TrustManager\z + - variable: NULL_X509_CERTIFICATE + detection: ssl_hostname_verifier_null_x509_cert + - pattern: | + class $<...>$<_> implements $ { + $$<...>X509Certificate[] getAcceptedIssuers() { + $[] $ = $; + return $; + } + }; + filters: + - variable: X509_TRUST_MANAGER + regex: \A(javax\.net\.ssl\.)?X509TrustManager\z + - variable: X509_CERTIFICATE_TYPE + regex: \A(java\.security\.cert\.)?X509Certificate\z + - variable: NULL_X509_CERTIFICATE + detection: ssl_hostname_verifier_null_x509_cert - pattern: | new $() { - $$<...>$<_> verify(String $<_>, $ $<_>) { + $$<...>$<_> verify($<...>String $<_>, $<...>$ $<_>) { return $; } }; @@ -83,7 +108,7 @@ patterns: detection: ssl_hostname_verifier_true - pattern: | class $<...>$<_> implements $ { - $$<...>$<_> verify(String $<_>, $ $<_>) { + $$<...>$<_> verify($<...>String $<_>, $<...>$ $<_>) { return $; } } diff --git a/tests/java/lang/ssl_hostname_verifier/testdata/main.java b/tests/java/lang/ssl_hostname_verifier/testdata/main.java index a428c81e0..d2946f50f 100644 --- a/tests/java/lang/ssl_hostname_verifier/testdata/main.java +++ b/tests/java/lang/ssl_hostname_verifier/testdata/main.java @@ -26,6 +26,13 @@ public boolean verify(String s, SSLSession sslSession) { } HttpsURLConnection.setDefaultHostnameVerifier(new DummyHostnameVerifier()); +class AllHosts implements HostnameVerifier { + // bearer:expected java_lang_ssl_hostname_verifier + public boolean verify(final String hostname, final SSLSession session) { + return true; + } +} + public void nullKeyManagerForSSLContext(TrustManager[] trustAllCertificates) { javax.net.ssl.SSLContext sc = javax.net.ssl.SSLContext.getInstance("SSL"); // bearer:expected java_lang_ssl_hostname_verifier