From 070bb05c46ebd6b46cacabe4fb1f857e528ecf07 Mon Sep 17 00:00:00 2001 From: "deepsource-dev-autofix[bot]" <61578317+deepsource-dev-autofix[bot]@users.noreply.github.com> Date: Mon, 14 Jul 2025 19:10:58 +0530 Subject: [PATCH] refactor: enforce https for post requests --- .../java/org/openmrs/util/HttpClient.java | 165 ++++++++++-------- 1 file changed, 88 insertions(+), 77 deletions(-) diff --git a/api/src/main/java/org/openmrs/util/HttpClient.java b/api/src/main/java/org/openmrs/util/HttpClient.java index 51decec1f77..d1c1efa5a9e 100644 --- a/api/src/main/java/org/openmrs/util/HttpClient.java +++ b/api/src/main/java/org/openmrs/util/HttpClient.java @@ -20,6 +20,9 @@ import java.nio.charset.StandardCharsets; import java.util.Map; +import javax.net.ssl.HttpsURLConnection; +import javax.net.ssl.SSLSocketFactory; + import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -41,89 +44,97 @@ public HttpClient(HttpUrl url) { this.url = url; } - public String post(Map parameters) { - OutputStreamWriter wr = null; - BufferedReader rd = null; - String response = ""; + public String post(Map parameters) { + OutputStreamWriter wr = null; + BufferedReader rd = null; + String response = ""; - try { - StringBuilder data = constructData(parameters); + try { + StringBuilder data = constructData(parameters); - // Send the data - HttpURLConnection connection = url.openConnection(); - connection.setDoOutput(true); - connection.setDoInput(true); - connection.setRequestMethod("POST"); - connection.setRequestProperty("Content-Length", String.valueOf(data.length())); - connection.setRequestProperty("Content-Type", "application/x-www-form-urlencoded"); + // Send the data over HTTPS only + if (!"https".equalsIgnoreCase(url.getProtocol())) { + throw new IllegalArgumentException("Insecure protocol not allowed. Use HTTPS."); + } + HttpsURLConnection connection = (HttpsURLConnection) url.openConnection(); + connection.setSSLSocketFactory((SSLSocketFactory) SSLSocketFactory.getDefault()); + connection.setDoOutput(true); + connection.setDoInput(true); + connection.setRequestMethod("POST"); + connection.setRequestProperty("Content-Length", String.valueOf(data.length())); + connection.setRequestProperty("Content-Type", "application/x-www-form-urlencoded"); - wr = new OutputStreamWriter(connection.getOutputStream(), StandardCharsets.UTF_8); - wr.write(data.toString()); - wr.flush(); - wr.close(); - - // only handle a single redirection, don't want to get - // caught in a redirection loop. - boolean redirect = false; - int status = connection.getResponseCode(); - if (status == HttpURLConnection.HTTP_MOVED_TEMP - || status == HttpURLConnection.HTTP_MOVED_PERM - || status == HttpURLConnection.HTTP_SEE_OTHER) { - redirect = true; - } - - if (redirect) { + wr = new OutputStreamWriter(connection.getOutputStream(), StandardCharsets.UTF_8); + wr.write(data.toString()); + wr.flush(); + wr.close(); + + // only handle a single redirection, don't want to get + // caught in a redirection loop. + boolean redirect = false; + int status = connection.getResponseCode(); + if (status == HttpURLConnection.HTTP_MOVED_TEMP + || status == HttpURLConnection.HTTP_MOVED_PERM + || status == HttpURLConnection.HTTP_SEE_OTHER) { + redirect = true; + } + + if (redirect) { - // get redirect url from "location" header field - String newUrl = connection.getHeaderField("Location"); - connection = (HttpURLConnection)new URL(newUrl).openConnection(); + // get redirect url from "location" header field + String newUrl = connection.getHeaderField("Location"); + URL redirectUrl = new URL(newUrl); + if (!"https".equalsIgnoreCase(redirectUrl.getProtocol())) { + throw new IllegalArgumentException("Insecure protocol not allowed. Use HTTPS."); + } + connection = (HttpsURLConnection) redirectUrl.openConnection(); + connection.setSSLSocketFactory((SSLSocketFactory) SSLSocketFactory.getDefault()); - log.info("Redirection to : " + newUrl); + log.info("Redirection to : " + newUrl); - // reset connection options & data - connection.setDoOutput(true); - connection.setDoInput(true); - connection.setRequestMethod("POST"); - connection.setRequestProperty("Content-Length", String.valueOf(data.length())); - connection.setRequestProperty("Content-Type", "application/x-www-form-urlencoded"); - - wr = new OutputStreamWriter(connection.getOutputStream(), StandardCharsets.UTF_8); - wr.write(data.toString()); - wr.flush(); - wr.close(); - } - - // Get the response - rd = new BufferedReader(new InputStreamReader(connection.getInputStream(), StandardCharsets.UTF_8)); - String line; - while ((line = rd.readLine()) != null) { - response = String.format("%s%s%n", response, line); - } - - } - catch (Exception e) { - log.warn("Exception while posting to : " + this.url, e); - log.warn("Reponse from server was: " + response); - } - finally { - if (wr != null) { - try { - wr.close(); - } - catch (Exception e) { /* pass */ - } - } - if (rd != null) { - try { - rd.close(); - } - catch (Exception e) { /* pass */ - } - } - } - - return response; - } + // reset connection options & data + connection.setDoOutput(true); + connection.setDoInput(true); + connection.setRequestMethod("POST"); + connection.setRequestProperty("Content-Length", String.valueOf(data.length())); + connection.setRequestProperty("Content-Type", "application/x-www-form-urlencoded"); + + wr = new OutputStreamWriter(connection.getOutputStream(), StandardCharsets.UTF_8); + wr.write(data.toString()); + wr.flush(); + wr.close(); + } + + // Get the response + rd = new BufferedReader(new InputStreamReader(connection.getInputStream(), StandardCharsets.UTF_8)); + String line; + while ((line = rd.readLine()) != null) { + response = String.format("%s%s%n", response, line); + } + + } + catch (Exception e) { + log.warn("Exception while posting to : " + this.url, e); + } + finally { + if (wr != null) { + try { + wr.close(); + } + catch (Exception e) { /* pass */ + } + } + if (rd != null) { + try { + rd.close(); + } + catch (Exception e) { /* pass */ + } + } + } + + return response; + } private StringBuilder constructData(Map parameters) throws UnsupportedEncodingException { StringBuilder data = new StringBuilder();