From 05a7ab091f1abb2bee0260be8fd30479e5b5cecd Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Wed, 8 Jul 2026 17:46:40 +0300 Subject: [PATCH] Handle the STRICT host name verifier explicitly (CodeQL java/missing-case-in-switch) AsyncHttpClientProvider switched on the HostnameVerifier option but only had a case for ALLOW_ALL, relying on a pre-initialised DefaultHostnameVerifier to cover STRICT. Give the switch a default branch that assigns the strict verifier, the same shape already used by SyncHttpClientProvider. Behaviour is unchanged - STRICT still maps to DefaultHostnameVerifier - but the switch now covers every enum value and the two client providers are consistent. --- .../http/apache/async/AsyncHttpClientProvider.java | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/commons/http-framework/client-apache-async/src/main/java/org/forgerock/http/apache/async/AsyncHttpClientProvider.java b/commons/http-framework/client-apache-async/src/main/java/org/forgerock/http/apache/async/AsyncHttpClientProvider.java index cd0425a45c..dc31a7b4b0 100644 --- a/commons/http-framework/client-apache-async/src/main/java/org/forgerock/http/apache/async/AsyncHttpClientProvider.java +++ b/commons/http-framework/client-apache-async/src/main/java/org/forgerock/http/apache/async/AsyncHttpClientProvider.java @@ -12,6 +12,7 @@ * information: "Portions Copyright [year] [name of copyright owner]". * * Copyright 2015 ForgeRock AS. + * Portions Copyrighted 2026 3A Systems, LLC */ package org.forgerock.http.apache.async; @@ -128,11 +129,15 @@ public HttpClient newHttpClient(final Options options) throws HttpApplicationExc throw new HttpApplicationException("Can't create SSL Context", e); } - HostnameVerifier verifier = new DefaultHostnameVerifier(); + final HostnameVerifier verifier; switch (options.get(OPTION_HOSTNAME_VERIFIER)) { case ALLOW_ALL: verifier = NoopHostnameVerifier.INSTANCE; break; + default: + // STRICT (and any future policy) uses strict host name verification. + verifier = new DefaultHostnameVerifier(); + break; } List protocols = options.get(OPTION_SSL_ENABLED_PROTOCOLS);