Core: `SecurityUtils.createMtlsKeyStore` should use a fixed algorithm for creating the `PrivateKey`
还没有人认领这个 Issue。
评估
调研方向
从 SecurityUtils.createMtlsKeyStore 开始，检查 issue 中所示的 KeyFactory 调用周围当前对 IllegalArgumentException 的处理。查看 Error Prone 关于 InsecureCipherMode 的指导以及 InvalidAlgorithmParameterException API，然后在启用 Error Prone 的情况下运行构建。完成的标准是：不安全或不受支持的密钥算法按照指定方式处理，并且警告得到解决。
由索引模型根据 Issue 内容生成。
描述
Callers of SecurityUtils.createMtlsKeyStore can direct the use of insecure algorithms in the construction of the mTLS connection. In general, we attempt to affix the algorithm used to inhibit use of algorithms with known vulnerabilities.
Personally, I would be fine with denying provided certs whose cert.getPublicKey().getAlgorithm() was DH or DSA, but in lieu of blocklisting known bad algorithms, perhaps it'd be more security affirmative to allowlist currently-OK algorithms, so we only ever use good versions, and suffer toil later if we have to retrofit additional entries.
My suggestion is to create a case statement just below where the method currently throws IllegalArgumentException for various cases, and add the set of known good algorithms, and throw an InvalidAlgorithmParameterException if it is not one of those. In addition, special case DH and DSA to give references to their vulnerabilities as described in InsecureCypherMode.identifyDiffieHellmanAndDsaVulnerabilities.
/cc @sophieschmieg, as her guidance/requirements will be canonical for importing whatever changes are made here into the monorepo.
Environment details
- API: Core
- OS type and version: 5.17.6-1rodete1-amd64
- Java version: OpenJDK Runtime Environment (build 11.0.13+8-google-release-451398016) OpenJDK 64-Bit Server VM (build 11.0.13+8-google-release-451398016, mixed mode, sharing)
- version(s): ~head (with local patches)
Steps to reproduce
- Add errorprone warnings to the build
- Build.
SecurityUtils.createMtlsKeyStore will generate an InsecureCipherMode warning.
Code example
PrivateKey key =
KeyFactory.getInstance(cert.getPublicKey().getAlgorithm()).generatePrivate(keySpecPKCS8);
- 主要语言
- Java
- 星标
- 1.4k
- 派生
- 476
- 平均合并
- 10 小时 47 分钟
- 30 天内合并 PR
- 3
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
googleapis/google-http-java-client 的其他 Issue
-
Core: Validate header names and values to prevent CRLF injection可能已有人在做 @insaf021 于 106 天前认领。 未关闭priority: p3
难度 2/5 1-3 小时 新手友好度 78/100
-
Core: XmlPullParser processes external DTD entities (XXE) — disable FEATURE_PROCESS_DOCDECL in Xml#createParser()可能已有人在做 @insaf021 于 106 天前认领。 未关闭priority: p3
难度 2/5 1-3 小时 新手友好度 84/100
-
Core: LowLevelHttpResponse not disconnected when HttpResponse construction throws RuntimeException可能已有人在做 @insaf021 于 106 天前认领。 未关闭priority: p3
难度 2/5 1-3 小时 新手友好度 84/100
-
type: cleanup
难度 2/5 1-3 小时 新手友好度 68/100
-
org.apache.http.conn.ssl.SSLSocketFactory is deprecated可能重新可做 关联的 PR 已关闭且未合并。 未关闭priority: p2 type: cleanup
难度 2/5 1-3 小时 新手友好度 65/100
查看 googleapis/google-http-java-client 的全部 Issue
相似的 Issue
-
难度 1/5 1 小时以内 新手友好度 88/100
-
难度 2/5 1 小时以内 新手友好度 84/100
cpp-best-practices/project_validator#251 ·
维护者通常 1 天内回复
-
backend enhancement
难度 2/5 半天 新手友好度 70/100
damodharg6/payledger#16 ·
-
[Bug]: An initiative list with no current entry logs an error on every change可能已有人在做 @dwizard0 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 85/100
维护者通常 1 天内回复