-
Notifications
You must be signed in to change notification settings - Fork 868
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
FIX: [CodeQL: SM02184] Server certificate validation disabled in VssUtil.cs #5068
base: master
Are you sure you want to change the base?
FIX: [CodeQL: SM02184] Server certificate validation disabled in VssUtil.cs #5068
Conversation
LGTM, but please verify that this is not a breaking change for customers who use self-signed certificates. |
Looking at the code, this may result in a degradation of error logging |
@@ -167,7 +168,7 @@ private static bool CheckSupportOfCustomServerCertificateValidation(ITraceWriter | |||
{ | |||
using (var handler = new HttpClientHandler()) | |||
{ | |||
handler.ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => { return true; }; | |||
handler.ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => { return errors == SslPolicyErrors.None; }; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I suspect this is equivalent to not handling the event at all. I agree with the concerns about the impact on self-signed certificates with this change.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Putting this to "request changed" for discussion
Context
The agent SDK logs the SSL diagnostic data into the trace, if there is Support of Custom Server Certificate Validation.
To check whether the current platform and configuration supports custom server certificate validation, the
CheckSupportOfCustomServerCertificateValidation
method is used in theVssUtil.cs
file, which implements a certificate validation callback function which performs a SSL handshake with a test uri namely microsoft.com and is set to always returnstrue
.Change Description
The custom server certificate validator function now checks for any SSL errors.
Validation