mcp-server-semgrep/semgrep-rules/java/lang/security/audit/crypto/ssl/insecure-trust-manager.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: insecure-trust-manager
  metadata:
    cwe:
    - 'CWE-295: Improper Certificate Validation'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A07:2021 - Identification and Authentication Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_TRUST_MANAGER
    asvs:
      section: V9 Communications Verification Requirements
      control_id: 9.2.1 Weak TLS
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements
      version: '4'
    references:
    - https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https
    category: security
    technology:
    - java
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
  message: >-
    Detected empty trust manager implementations. This is dangerous because it accepts
    any
    certificate, enabling man-in-the-middle attacks. Consider using a KeyStore
    and TrustManagerFactory instead.
    See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https
    for more information.
  severity: WARNING
  languages: [java]
  patterns:
  - pattern-either:
    - pattern-inside: |
        class $CLASS implements X509TrustManager {
          ...
        }
    - pattern-inside: |
        new X509TrustManager() {
          ...
        }
    - pattern-inside: |
        class $CLASS implements X509ExtendedTrustManager {
          ...
        }
    - pattern-inside: |
        new X509ExtendedTrustManager() {
          ...
        }
  - pattern-not: public void checkClientTrusted(...) { $SOMETHING; }
  - pattern-not: public void checkServerTrusted(...) { $SOMETHING; }
  - pattern-either:
    - pattern: public void checkClientTrusted(...) {}
    - pattern: public void checkServerTrusted(...) {}
    - pattern: public X509Certificate[] getAcceptedIssuers(...) { return null; }