Files
codeql/java/ql/test/query-tests/security/CWE-295/AndroidMissingCertificatePinning/Test3/Test.java
Tony Torralba bd8f35bef7 Java: Fix FPs in Missing certificate pinning
Local URIs should never require pinning
2023-12-12 18:02:12 +01:00

23 lines
1.0 KiB
Java

import okhttp3.OkHttpClient;
import okhttp3.CertificatePinner;
import okhttp3.Request;
class Test {
void test1() throws Exception {
CertificatePinner certificatePinner = new CertificatePinner.Builder()
.add("good.example.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
.build();
OkHttpClient client =
new OkHttpClient.Builder().certificatePinner(certificatePinner).build();
client.newCall(new Request.Builder().url("https://good.example.com").build()).execute();
client.newCall(new Request.Builder().url("https://bad.example.com").build()).execute(); // $hasUntrustedResult
client.newCall(new Request.Builder().url("classpath:example/directory/test.class").build())
.execute();
client.newCall(new Request.Builder().url("file:///example/file").build()).execute();
client.newCall(
new Request.Builder().url("jar:file:///C:/example/test.jar!/test.xml").build())
.execute();
}
}