(ofbiz-framework) branch trunk updated: Fixed: URLConnector.openUntrustedConnection(...) public overloads silently performed trusted SSL connections (OFBIZ-13484) (#1569)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 192510b305 Fixed: URLConnector.openUntrustedConnection(...) public 
overloads silently performed trusted SSL connections (OFBIZ-13484) (#1569)
192510b305 is described below

commit 192510b305269e3eb4a7ddc0226f297b3e01cd0d
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Fri Aug 7 10:49:36 2026 +0530

    Fixed: URLConnector.openUntrustedConnection(...) public overloads silently 
performed trusted SSL connections (OFBIZ-13484) (#1569)
    
    Fixed: URLConnector.openUntrustedConnection(...) public overloads silently 
performed trusted SSL connections (OFBIZ-13484)
    
    The three public openUntrustedConnection overloads delegated to the trusted 
openConnection(...) path instead of the untrusted one, so trustAnyCert was 
always false despite the method name and "allow untrusted certs" comment. Only 
the package-private 4-arg overload (the one HttpClient actually calls) set 
trustAnyCert=true correctly. This change makes the three public overloads 
delegate to openUntrustedConnection(...) instead, mirroring the existing 
trusted-path delegation pattern. Not  [...]
---
 .../base/src/main/java/org/apache/ofbiz/base/util/URLConnector.java | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git 
a/framework/base/src/main/java/org/apache/ofbiz/base/util/URLConnector.java 
b/framework/base/src/main/java/org/apache/ofbiz/base/util/URLConnector.java
index dc4c31de8e..d7a7b2063c 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/URLConnector.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/URLConnector.java
@@ -100,15 +100,15 @@ public class URLConnector {
 
     // allow untrusted certs
     public static URLConnection openUntrustedConnection(URL url) throws 
IOException {
-        return openConnection(url, 30000);
+        return openUntrustedConnection(url, 30000);
     }
 
     public static URLConnection openUntrustedConnection(URL url, int timeout) 
throws IOException {
-        return openConnection(url, timeout, null, 
SSLUtil.getHostCertNormalCheck());
+        return openUntrustedConnection(url, timeout, null, 
SSLUtil.getHostCertNormalCheck());
     }
 
     public static URLConnection openUntrustedConnection(URL url, String 
clientCertAlias) throws IOException {
-        return openConnection(url, 30000, clientCertAlias, 
SSLUtil.getHostCertNormalCheck());
+        return openUntrustedConnection(url, 30000, clientCertAlias, 
SSLUtil.getHostCertNormalCheck());
     }
 
     static URLConnection openUntrustedConnection(URL url, int timeout, String 
clientCertAlias, int hostCertLevel) throws IOException {