57 lines
2.2 KiB
Plaintext
57 lines
2.2 KiB
Plaintext
This rule raises an issue when:
|
|
|
|
* a JavaMail's ``++javax.mail.Session++`` is created with a ``++Properties++`` object having no ``++mail.smtp.ssl.checkserveridentity++`` or ``++mail.smtps.ssl.checkserveridentity++`` not configured to ``++true++``
|
|
* a Apache Common Emails's ``++org.apache.commons.mail.SimpleEmail++`` is used with ``++setSSLOnConnect(true)++`` or ``++setStartTLSEnabled(true)++`` or ``++setStartTLSRequired(true)++`` without a call to ``++setSSLCheckServerIdentity(true)++``
|
|
|
|
== Noncompliant Code Example
|
|
|
|
----
|
|
Email email = new SimpleEmail();
|
|
email.setSmtpPort(465);
|
|
email.setAuthenticator(new DefaultAuthenticator(username, password));
|
|
email.setSSLOnConnect(true); // Noncompliant; setSSLCheckServerIdentity(true) should also be called before sending the email
|
|
email.send();
|
|
----
|
|
|
|
----
|
|
Properties props = new Properties();
|
|
props.put("mail.smtp.host", "smtp.gmail.com");
|
|
props.put("mail.smtp.socketFactory.port", "465");
|
|
props.put("mail.smtp.socketFactory.class", "javax.net.ssl.SSLSocketFactory"); // Noncompliant; Session is created without having "mail.smtp.ssl.checkserveridentity" set to true
|
|
props.put("mail.smtp.auth", "true");
|
|
props.put("mail.smtp.port", "465");
|
|
Session session = Session.getDefaultInstance(props, new javax.mail.Authenticator() {
|
|
protected PasswordAuthentication getPasswordAuthentication() {
|
|
return new PasswordAuthentication("username@gmail.com", "password");
|
|
}
|
|
});
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
----
|
|
Email email = new SimpleEmail();
|
|
email.setSmtpPort(465);
|
|
email.setAuthenticator(new DefaultAuthenticator(username, password));
|
|
email.setSSLOnConnect(true);
|
|
email.setSSLCheckServerIdentity(true); // Compliant
|
|
email.send();
|
|
----
|
|
|
|
----
|
|
Properties props = new Properties();
|
|
props.put("mail.smtp.host", "smtp.gmail.com");
|
|
props.put("mail.smtp.socketFactory.port", "465");
|
|
props.put("mail.smtp.socketFactory.class", "javax.net.ssl.SSLSocketFactory");
|
|
props.put("mail.smtp.auth", "true");
|
|
props.put("mail.smtp.port", "465");
|
|
props.put("mail.smtp.ssl.checkserveridentity", true); // Compliant
|
|
Session session = Session.getDefaultInstance(props, new javax.mail.Authenticator() {
|
|
protected PasswordAuthentication getPasswordAuthentication() {
|
|
return new PasswordAuthentication("username@gmail.com", "password");
|
|
}
|
|
});
|
|
----
|
|
|
|
include::../see.adoc[]
|