Add custom verifier to hostname verification by HTTP client

core/org.wso2.carbon.utils/pom.xml

@@ -229,6 +229,10 @@
             <groupId>com.google.code.gson</groupId>
             <artifactId>gson</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.wso2.orbit.org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+        </dependency>
     </dependencies>
 
     <properties>

core/org.wso2.carbon.utils/src/main/java/org/wso2/carbon/utils/CustomHostNameVerifier.java

@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2023, WSO2 LLC. (http://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.wso2.carbon.utils;
+
+import org.apache.commons.lang.ArrayUtils;
+import org.apache.http.conn.ssl.AbstractVerifier;
+import javax.net.ssl.SSLException;
+import java.util.Optional;
+
+/**
+ * Custom hostname verifier class.
+ */
+public class CustomHostNameVerifier extends AbstractVerifier {
+
+    private final static String[] LOCALHOSTS = {"::1", "127.0.0.1", "localhost", "localhost.localdomain"};
+
+    @Override
+    public void verify(String hostname, String[] commonNames, String[] subjectAlternativeNames) throws SSLException {
+
+        String[] subjectAltsWithLocalhosts = (String[]) ArrayUtils.addAll(subjectAlternativeNames, LOCALHOSTS);
+
+        boolean hasValidCommonNames = Optional.ofNullable(commonNames)
+                .filter(names -> names.length > 0)
+                .map(names -> names[0])
+                .isPresent();
+        if (hasValidCommonNames && !ArrayUtils.contains(subjectAlternativeNames, commonNames[0])) {
+            subjectAltsWithLocalhosts = (String[]) ArrayUtils.add(subjectAltsWithLocalhosts, commonNames[0]);
+        }
+        super.verify(hostname, commonNames, subjectAltsWithLocalhosts, false);
+    }
+}

core/org.wso2.carbon.utils/src/main/java/org/wso2/carbon/utils/HTTPClientUtils.java

@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2023, WSO2 LLC. (http://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.wso2.carbon.utils;
+
+import org.apache.http.conn.ssl.X509HostnameVerifier;
+import org.apache.http.impl.client.HttpClientBuilder;
+
+/**
+ * Util methods for HTTP Client.
+ */
+public class HTTPClientUtils {
+
+    public static final String DEFAULT_AND_LOCALHOST = "DefaultAndLocalhost";
+    public static final String HOST_NAME_VERIFIER = "httpclient.hostnameVerifier";
+
+    private HTTPClientUtils() {
+        //disable external instantiation
+    }
+
+    /**
+     * Get the httpclient builder with custom hostname verifier.
+     *
+     * @return HttpClientBuilder.
+     */
+    public static HttpClientBuilder createClientWithCustomVerifier() {
+
+        HttpClientBuilder httpClientBuilder = HttpClientBuilder.create().useSystemProperties();
+        if (DEFAULT_AND_LOCALHOST.equals(System.getProperty(HOST_NAME_VERIFIER))) {
+            X509HostnameVerifier hostnameVerifier = new CustomHostNameVerifier();
+            httpClientBuilder.setHostnameVerifier(hostnameVerifier);
+        }
+
+        return httpClientBuilder;
+    }
+}

parent/pom.xml

@@ -654,6 +654,9 @@
         <config.mapper.version>1.0.13</config.mapper.version>
         <version.stax.ex>1.8.3</version.stax.ex>
         <version.saaj.impl>1.5.0</version.saaj.impl>
+
+        <httpcomponents-httpclient.wso2.version>4.5.13.wso2v1</httpcomponents-httpclient.wso2.version>
+        <httpcomponents-httpclient.imp.pkg.version.range>[4.3.1.wso2v2,5.0.0)</httpcomponents-httpclient.imp.pkg.version.range>
     </properties>
 
     <dependencyManagement>
@@ -1917,6 +1920,11 @@
                 <artifactId>stax-ex</artifactId>
                 <version>${version.stax.ex}</version>
             </dependency>
+            <dependency>
+                <groupId>org.wso2.orbit.org.apache.httpcomponents</groupId>
+                <artifactId>httpclient</artifactId>
+                <version>${httpcomponents-httpclient.wso2.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 </project>