[java-opensaml2 COMMIT] in /branches/REL_2: doc/RELEASE-NOTES.txt src/main/java/org/opensaml/DefaultBootstrap.java

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Aug  8 18:36:08 2014
New Revision: 1666

URL: http://svn.shibboleth.net/view/java-opensaml2?rev=1666&view=rev
Log:
JOST-238: https:// URLs with HttpResource or FileBackedHttpResource are vulnerable to MitM attacks (missing hostname verification)

Modified:
    branches/REL_2/doc/RELEASE-NOTES.txt
    branches/REL_2/src/main/java/org/opensaml/DefaultBootstrap.java

Modified: branches/REL_2/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-opensaml2/branches/REL_2/doc/RELEASE-NOTES.txt?rev=1666&r1=1665&r2=1666&view=diff
==============================================================================
--- branches/REL_2/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_2/doc/RELEASE-NOTES.txt Fri Aug  8 18:36:08 2014
@@ -3,6 +3,7 @@
 [JOST-223] - Misspelled error constant in SAML 1 StatusCode interface
 [JOST-224] - Superfluous/wrong type constants in SAML 1 and SAML 2 interfaces
 [JOST-226] - Mispelled method name in SAMLMDCredentialContext, getEncryptionMethod vs getEncryptionMethods 
+[JOST-238] - https:// URLs with HttpResource or FileBackedHttpResource are vulnerable to MitM attacks (missing hostname verification)
 
 Changes in Release 2.6.1
 =============================================

Modified: branches/REL_2/src/main/java/org/opensaml/DefaultBootstrap.java
URL: http://svn.shibboleth.net/view/java-opensaml2/branches/REL_2/src/main/java/org/opensaml/DefaultBootstrap.java?rev=1666&r1=1665&r2=1666&view=diff
==============================================================================
--- branches/REL_2/src/main/java/org/opensaml/DefaultBootstrap.java (original)
+++ branches/REL_2/src/main/java/org/opensaml/DefaultBootstrap.java Fri Aug  8 18:36:08 2014
@@ -17,9 +17,12 @@
 
 package org.opensaml;
 
+import org.apache.commons.httpclient.protocol.Protocol;
+import org.apache.commons.httpclient.protocol.ProtocolSocketFactory;
 import org.apache.xml.security.Init;
 import org.opensaml.saml1.binding.artifact.SAML1ArtifactBuilderFactory;
 import org.opensaml.saml2.binding.artifact.SAML2ArtifactBuilderFactory;
+import org.opensaml.ws.soap.client.http.TLSProtocolSocketFactory;
 import org.opensaml.xml.ConfigurationException;
 import org.opensaml.xml.XMLConfigurator;
 import org.opensaml.xml.parse.StaticBasicParserPool;
@@ -33,6 +36,10 @@
  * This class can be used to bootstrap the OpenSAML library with the default configurations that ship with the library.
  */
 public class DefaultBootstrap {
+    
+    /** System property used to disable global default HTTPS hostname verification in Apache Commons HttpClient. */
+    public static final String SYSPROP_HTTPCLIENT_HTTPS_DISABLE_HOSTNAME_VERIFICATION = 
+            "org.opensaml.httpclient.https.disableHostnameVerification";
 
     /** List of default XMLTooling configuration files. */
     private static String[] xmlToolingConfigs = { 
@@ -98,6 +105,19 @@
         initializeParserPool();
         
         initializeESAPI();
+        
+        initializeHttpClient();
+    }
+
+    /**
+     *  Initializes the Apache Commons HttpClient library.
+     */
+    protected static void initializeHttpClient() {
+        if (!Boolean.getBoolean(SYSPROP_HTTPCLIENT_HTTPS_DISABLE_HOSTNAME_VERIFICATION)) {
+            ProtocolSocketFactory socketFactory = 
+                    new TLSProtocolSocketFactory(null, null, org.apache.commons.ssl.HostnameVerifier.STRICT);
+            Protocol.registerProtocol("https", new Protocol("https", socketFactory, 443));
+        }
     }
 
     /**