+
+
+ An HTTP server which does not use SSL/TLS is vulnerable to man-in-the-middle attacks.
+
+
+ Please, note that it may be safe to ignore this, only if you intend your application to be placed
+ behind a loadbalancer, which is itself securing the connections with the appropriate certificates.
+
+
+
+
+ Use SSL/TLS to encrypt the communication between the client and the server.
+
+
+
+ Instead of setting up a plain HTTP server that doesn't use SSL, such as this one:
+
+
+
+
+ when creating an HTTP server, the setSsl method should be called on the
+ HttpServerOptions
+ object, and the setKeyStoreOptions method should be called on the
+ HttpServerOptions
+ object with a KeyStoreOptions
+ object as an argument.
+
+ For example, code such as the one illustrated below should be used to create an HTTP server and secure
+ it with SSL:
+
+
+
+
+
+
+
+
+ Vert.x documentation
+
+
+
+
diff --git a/vertx-codeql-queries/ql/src/InsecureHttpServer.ql b/vertx-codeql-queries/ql/src/InsecureHttpServer.ql
new file mode 100644
index 0000000..833eb86
--- /dev/null
+++ b/vertx-codeql-queries/ql/src/InsecureHttpServer.ql
@@ -0,0 +1,44 @@
+/**
+ * @name Use of insecure HTTP server
+ * @description The Vert.x HTTP server established insecure connections which are not using SSL/TLS.
+ * @kind problem
+ * @problem.severity high
+ * @id java/vertx/insecure-http-server
+ * @tags security java/vertx
+ */
+
+import java
+import semmle.code.java.StringFormat
+
+class Vertx extends RefType {
+ Vertx() {
+ this.getASourceSupertype*().hasQualifiedName("io.vertx.core", "Vertx")
+ }
+}
+
+class VertxCreateHttpServerMethodAccess extends MethodAccess {
+ VertxCreateHttpServerMethodAccess() {
+ exists(Method m |
+ this.getMethod() = m and
+ m.getName().matches("createHttpServer") and
+ m.getDeclaringType() instanceof Vertx
+ )
+ }
+}
+
+class HttpOptionsExpr extends Expr {
+ HttpOptionsExpr() {
+ exists()
+ }
+}
+
+// TODO: This does not cover HttpOptions being passed.
+
+from VertxCreateHttpServerMethodAccess call, Expr expr, StringFormatMethod format
+where
+ not call.getEnclosingCallable().getDeclaringType() instanceof Vertx and
+ not call.getLocation().getFile().getRelativePath().matches("%src/test/%") and
+ call.getNumArgument() = 0
+select
+ call,
+ "Insecure HTTP server which allows unencrypted HTTP connections"
diff --git a/vertx-codeql-queries/ql/src/SecureCorsServer.java b/vertx-codeql-queries/ql/src/SecureCorsServer.java
new file mode 100644
index 0000000..f9f0b0c
--- /dev/null
+++ b/vertx-codeql-queries/ql/src/SecureCorsServer.java
@@ -0,0 +1,61 @@
+package org.carlspring.security.vertx.http;
+
+import io.vertx.core.AbstractVerticle;
+import io.vertx.core.http.HttpHeaders;
+import io.vertx.core.http.HttpMethod;
+import io.vertx.ext.web.Router;
+import io.vertx.ext.web.handler.CorsHandler;
+
+/**
+ * @author carlspring
+ */
+public class SecureCorsServer extends AbstractVerticle {
+
+ @Override
+ public void start() {
+ // Create a router
+ Router router = Router.router(vertx);
+
+ // Configure CORS handling with allowed origins, headers, and methods
+ CorsHandler corsHandler = CorsHandler.create()
+ // 1) Use HTTPS
+ // 2) Use an explicitly defined origin
+ .addOrigin("https://example.com")
+ // 3) Define allowed headers
+ .allowedHeader(HttpHeaders.CONTENT_TYPE.toString())
+ // 4) Define allowed methods
+ .allowedMethod(HttpMethod.GET)
+ .allowedMethod(HttpMethod.POST);
+
+ // Mount the CORS handler
+ router.route().handler(corsHandler);
+
+ // Set up routes
+ router.get("/api/data").handler(routingContext -> {
+ // Handle the request and send response
+ routingContext.response()
+ .putHeader(HttpHeaders.CONTENT_TYPE, "application/json")
+ .end("{\"message\":\"Hello, CORS!\"}");
+ });
+
+ // Set up SSL
+ HttpServerOptions options = new HttpServerOptions()
+ // Set up SSL
+ .setSsl(true)
+ // Set up keystore
+ .setKeyStoreOptions(new JksOptions().setPath("keystore.jks")
+ .setPassword("keystore_password"));
+
+ // Start the server
+ vertx.createHttpServer(options)
+ .requestHandler(router)
+ .listen(8080, ar -> {
+ if (ar.succeeded()) {
+ System.out.println("Server started on port 8080");
+ } else {
+ System.err.println("Server failed to start: " + ar.cause());
+ }
+ });
+ }
+
+}
diff --git a/vertx-codeql-queries/ql/src/SecureHttpServer.java b/vertx-codeql-queries/ql/src/SecureHttpServer.java
new file mode 100644
index 0000000..b16de5a
--- /dev/null
+++ b/vertx-codeql-queries/ql/src/SecureHttpServer.java
@@ -0,0 +1,40 @@
+package org.carlspring.security.vertx.http;
+
+import io.vertx.core.AbstractVerticle;
+import io.vertx.core.http.HttpServer;
+import io.vertx.core.http.HttpServerOptions;
+import io.vertx.core.http.HttpServerResponse;
+import io.vertx.core.net.JksOptions;
+
+/**
+ * @author carlspring
+ */
+public class SecureHttpServer extends AbstractVerticle {
+
+ @Override
+ public void start() {
+ HttpServerOptions options = new HttpServerOptions()
+ // Set up SSL
+ .setSsl(true)
+ // Set up keystore
+ .setKeyStoreOptions(new JksOptions().setPath("keystore.jks")
+ .setPassword("keystore_password"));
+
+ HttpServer server = vertx.createHttpServer(options);
+
+ server.requestHandler(request -> {
+ HttpServerResponse response = request.response();
+ response.putHeader("Content-Type", "text/plain");
+ response.end("Hello, World! This is a secure connection.");
+ });
+
+ server.listen(8443, "localhost", result -> {
+ if (result.succeeded()) {
+ System.out.println("Server started on port 8443 with SSL/TLS");
+ } else {
+ System.err.println("Server failed to start: " + result.cause());
+ }
+ });
+ }
+
+}
diff --git a/vertx-codeql-queries/ql/src/codeql-pack.lock.yml b/vertx-codeql-queries/ql/src/codeql-pack.lock.yml
new file mode 100644
index 0000000..d9c2623
--- /dev/null
+++ b/vertx-codeql-queries/ql/src/codeql-pack.lock.yml
@@ -0,0 +1,16 @@
+---
+lockVersion: 1.0.0
+dependencies:
+ codeql/java-all:
+ version: 0.6.2
+ codeql/regex:
+ version: 0.0.13
+ codeql/suite-helpers:
+ version: 0.4.1
+ codeql/tutorial:
+ version: 0.0.10
+ codeql/typetracking:
+ version: 0.0.10
+ codeql/util:
+ version: 0.0.10
+compiled: false
diff --git a/vertx-codeql-queries/ql/src/qlpack.yml b/vertx-codeql-queries/ql/src/qlpack.yml
new file mode 100644
index 0000000..bd117f0
--- /dev/null
+++ b/vertx-codeql-queries/ql/src/qlpack.yml
@@ -0,0 +1,10 @@
+---
+name: carlspring/vertx-codeql-queries
+version: 1.0.0-alpha
+library: false
+warnOnImplicitThis: false
+extractor: java
+dependencies:
+ codeql/java-all: "*"
+ codeql/suite-helpers: "*"
+license: Apache-2.0
diff --git a/vertx-codeql-queries/ql/src/queries.xml b/vertx-codeql-queries/ql/src/queries.xml
new file mode 100644
index 0000000..0d33187
--- /dev/null
+++ b/vertx-codeql-queries/ql/src/queries.xml
@@ -0,0 +1 @@
+