Core: `SecurityUtils.createMtlsKeyStore` should use a fixed algorithm for creating the `PrivateKey`
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Start at SecurityUtils.createMtlsKeyStore and inspect the current IllegalArgumentException handling around the KeyFactory call shown in the issue. Review Error Prone's InsecureCipherMode guidance and the InvalidAlgorithmParameterException API, then run the build with Error Prone enabled. Done means unsafe or unsupported key algorithms are handled as specified and the warning is resolved.
Written by the indexing model from the issue text.
Description
Callers of SecurityUtils.createMtlsKeyStore can direct the use of insecure algorithms in the construction of the mTLS connection. In general, we attempt to affix the algorithm used to inhibit use of algorithms with known vulnerabilities.
Personally, I would be fine with denying provided certs whose cert.getPublicKey().getAlgorithm() was DH or DSA, but in lieu of blocklisting known bad algorithms, perhaps it'd be more security affirmative to allowlist currently-OK algorithms, so we only ever use good versions, and suffer toil later if we have to retrofit additional entries.
My suggestion is to create a case statement just below where the method currently throws IllegalArgumentException for various cases, and add the set of known good algorithms, and throw an InvalidAlgorithmParameterException if it is not one of those. In addition, special case DH and DSA to give references to their vulnerabilities as described in InsecureCypherMode.identifyDiffieHellmanAndDsaVulnerabilities.
/cc @sophieschmieg, as her guidance/requirements will be canonical for importing whatever changes are made here into the monorepo.
Environment details
- API: Core
- OS type and version: 5.17.6-1rodete1-amd64
- Java version: OpenJDK Runtime Environment (build 11.0.13+8-google-release-451398016) OpenJDK 64-Bit Server VM (build 11.0.13+8-google-release-451398016, mixed mode, sharing)
- version(s): ~head (with local patches)
Steps to reproduce
- Add errorprone warnings to the build
- Build.
SecurityUtils.createMtlsKeyStore will generate an InsecureCipherMode warning.
Code example
PrivateKey key =
KeyFactory.getInstance(cert.getPublicKey().getAlgorithm()).generatePrivate(keySpecPKCS8);
- Dominant language
- Java
- Stars
- 1.4k
- Forks
- 476
- Avg merge
- 10h 47m
- Merged PRs (30d)
- 3
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from googleapis/google-http-java-client
-
Core: Validate header names and values to prevent CRLF injectionPossibly taken @insaf021 claimed this 106 days ago. Openpriority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Core: XmlPullParser processes external DTD entities (XXE) — disable FEATURE_PROCESS_DOCDECL in Xml#createParser()Possibly taken @insaf021 claimed this 106 days ago. Openpriority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Core: LowLevelHttpResponse not disconnected when HttpResponse construction throws RuntimeExceptionPossibly taken @insaf021 claimed this 106 days ago. Openpriority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
type: cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
org.apache.http.conn.ssl.SSLSocketFactory is deprecatedMay be free again A pull request for this issue was closed without being merged. Openpriority: p2 type: cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
All issues in googleapis/google-http-java-client
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Difficulty 2/5 Under an hour Newbie friendliness 84/100
cpp-best-practices/project_validator#251 ·
Maintainers usually reply within 1 day
-
backend enhancement
Difficulty 2/5 Half a day Newbie friendliness 70/100
damodharg6/payledger#16 ·
-
[Bug]: An initiative list with no current entry logs an error on every changePossibly taken @dwizard0 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
Maintainers usually reply within 1 day