codeql: close insecure-trustmanager + unsafe-hostname + url-forward + redos (Task 8) - #45
Merged
Merged
Conversation
…-forward #568 + redos #610 (Task 8) Real fixes (CodeQL-modeled) for 4 alerts across 3 modules: 1. PSSiteImporter.overrideConnectionProperties (java/insecure-trustmanager #594): replaced all-trusting X509TrustManager with JVM default TrustManagerFactory managers (validates against cacerts). Also removes the always-true HostnameVerifier (java/unsafe-hostname-verification #584) - JVM default RFC 2818 host matching is kept. Matches 004 T046 (PR #1297) + T053 (PR #1342). 2. PSServletUtils.getDispatcher (java/unvalidated-url-forward #568): new validateForwardPath() rejects control chars/backslashes, '..' traversal segments (incl. query-string/bare shapes), and WEB-INF/META-INF targets before getRequestDispatcher. Matches 004 T052 (PR #1335). 3. PSFormEncodeDecodeHelper.fixCommentTags (java/redos #610): 64 KiB input cap + collapsed overlapping [\r\n] alternation into [^\- ] class for linear matching. Matches 004 T049 (PR #1333). Verification: compile + tests pass on all 3 modules (309 tests, 0 failures). No suppressions/paths-ignore needed. # Please enter the commit message for your changes. Lines starting # with '#' will be kept; you may remove them yourself if you want to. # An empty message aborts the commit. # # interactive rebase in progress; onto 76f4ae3 # Last command done (1 command done): # pick b7722aab13 codeql: close insecure-trustmanager #594 + unsafe-hostname #584 + url-forward #568 + redos #610 (Task 8) # No commands remaining. # You are currently rebasing branch 'codeql/trustmanager-forward-redos' on '76f4ae3e0f'. # # Changes to be committed: # modified: CHANGELOG.md # modified: modules/extensions-main/src/main/java/com/percussion/extensions/translations/PSFormEncodeDecodeHelper.java # modified: modules/servletutils/src/main/java/com/percussion/utils/servlet/PSServletUtils.java # modified: projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/PSSiteImporter.java #
Signed-off-by: Nate Chadwick <natechadwick@users.noreply.github.com>
natechadwick
approved these changes
Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes 4 CodeQL alerts with real fixes (CodeQL-modeled — no paths-ignore, no sink-line suppressions):
1. java/insecure-trustmanager (#594) + java/unsafe-hostname-verification (#584) — PSSiteImporter
overrideConnectionProperties()previously installed an all-trustingX509TrustManager(accepts any chain) plus an always-trueHostnameVerifier. Now:TrustManagerFactory— TLS certificates are validated against the system trust store (cacerts). Operators needing a private CA mustkeytool -importcert ... -cacerts.Matches 004 T046 (PR #1297) + T053 (PR #1342).
2. java/unvalidated-url-forward (#568) — PSServletUtils
getDispatcher(path)passed caller-controlled paths straight togetRequestDispatcher. NewvalidateForwardPath()runs before the container call and rejects:..traversal segments (start/mid/bare/query-string shapes)WEB-INF/META-INFtargets (full-segment match, accepts look-alikes like/web-info/notes)Matches 004 T052 (PR #1335).
3. java/redos (#610) — PSFormEncodeDecodeHelper
fixCommentTagsregex had an overlapping alternation (([^\- ]|[\r\n]|-[^\- ])*) that allowed ambiguous splits → exponential backtracking on adversarial input. Fix:[\r\n]into the[^\- ]class (superset — '\r'/'\n' are neither '-' nor space) → single non-overlapping path per char, linear matchingMatches 004 T049 (PR #1333).
Verification
Notes
*.versionproperties untouched.Version.propertieswas not modified.