You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "zendy199x (via GitHub)" <gi...@apache.org> on 2026/03/28 17:29:19 UTC
[PR] fix: insecure default behavior in SslClientAuth.forConfig [kafka]
zendy199x opened a new pull request, #21888:
URL: https://github.com/apache/kafka/pull/21888
Delete this text and replace it with a detailed description of your change. The
PR title and body will become the squashed commit message.
If you would like to tag individuals, add some commentary, upload images, or
include other supplemental information that should not be part of the eventual
commit message, please use a separate comment.
If applicable, please include a summary of the testing strategy (including
rationale) for the proposed change. Unit and/or integration tests are expected
for any behavior change and system tests should be considered for larger
changes.
fix: insecure default behavior in SslClientAuth.forConfig
The `forConfig` method returns `null` when an invalid configuration key is provided, instead of throwing an exception or using a default value. This could lead to unexpected behavior or misconfiguration in SSL client authentication settings, where a null value might be silently ignored or cause downstream failures. It's a security risk because misconfigured SSL settings could weaken the security posture.
Suggestion: Throw an `IllegalArgumentException` or return a default value (e.g., `SslClientAuth.NONE`) when the input key is invalid, ensuring that misconfigurations are caught early and explicitly handled.
Files changed:
- `clients/src/main/java/org/apache/kafka/common/config/SslClientAuth.java` (modified)
Commit message: fix(security): insecure default behavior in sslclientauth.forconfig
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: insecure default behavior in SslClientAuth.forConfig [kafka]
Posted by "zendy199x (via GitHub)" <gi...@apache.org>.
zendy199x commented on code in PR #21888:
URL: https://github.com/apache/kafka/pull/21888#discussion_r3005143460
##########
clients/src/main/java/org/apache/kafka/common/config/SslClientAuth.java:
##########
@@ -40,7 +40,7 @@ public static SslClientAuth forConfig(String key) {
return auth;
}
}
- return null;
+ return SslClientAuth.NONE;
Review Comment:
I reviewed the suggestion about "Changing the unrecognized-key behavior from returning `null` to returning `Ss..." against the current diff and addressed it in `fix: address PR review feedback`.
<!-- contribai:handled-comment:3005085071 -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: insecure default behavior in SslClientAuth.forConfig [kafka]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #21888: fix: insecure default behavior in SslClientAuth.forConfig
URL: https://github.com/apache/kafka/pull/21888
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: insecure default behavior in SslClientAuth.forConfig [kafka]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #21888:
URL: https://github.com/apache/kafka/pull/21888#issuecomment-5099998419
This PR has been closed since it has not had any activity in 120 days. If you feel like this
was a mistake, or you would like to continue working on it, please feel free to re-open the
PR and ask for a review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: insecure default behavior in SslClientAuth.forConfig [kafka]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #21888:
URL: https://github.com/apache/kafka/pull/21888#discussion_r3005085071
##########
clients/src/main/java/org/apache/kafka/common/config/SslClientAuth.java:
##########
@@ -40,7 +40,7 @@ public static SslClientAuth forConfig(String key) {
return auth;
}
}
- return null;
+ return SslClientAuth.NONE;
Review Comment:
Changing the unrecognized-key behavior from returning `null` to returning `SslClientAuth.NONE` removes the ability for callers to detect and surface misconfigurations. In this codebase, `DefaultSslEngineFactory#createSslClientAuth` checks `forConfig(key) != null` to decide whether to log a warning for unrecognized values; after this change, invalid values will silently downgrade to `NONE` (potentially disabling mTLS without any log/exception). Consider keeping `null` for unknown keys (and let callers decide the fallback), or throwing a `ConfigException`/`IllegalArgumentException` for unknown values, or introducing a separate strict/lenient parsing API so misconfiguration is still observable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: insecure default behavior in SslClientAuth.forConfig [kafka]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #21888:
URL: https://github.com/apache/kafka/pull/21888#issuecomment-4815280374
This PR is being marked as stale since it has not had any activity in 90 days. If you
would like to keep this PR alive, please leave a comment asking for a review. If the PR has
merge conflicts, update it with the latest from the base branch.
<p>
If you are having difficulty finding a reviewer, please reach out on the
[mailing list](https://kafka.apache.org/contact).
<p>
If this PR is no longer valid or desired, please feel free to close it. If no activity
occurs in the next 30 days, it will be automatically closed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org