(thrift) 03/09: Enable TLS hostname verification in TSSLTransportFactory Client: java

[je...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jensg pushed a commit to branch 0.23.0
in repository https://gitbox.apache.org/repos/asf/thrift.git

commit a30c552bd0808b7e19f35ad30212ba7a9aee8c66
Author: Jens Geyer <je...@apache.org>
AuthorDate: Sat Apr 11 12:29:10 2026 +0200

    Enable TLS hostname verification in TSSLTransportFactory
    Client: java
    
    Set EndpointIdentificationAlgorithm to HTTPS on SSLSocket parameters
    in createClient() so that the server certificate CN/SAN is validated
    against the target hostname during TLS handshake.
    
    (03)
    
    Co-Authored-By: Claude Opus 4.6 <no...@anthropic.com>
---
 .../main/java/org/apache/thrift/transport/TSSLTransportFactory.java   | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/java/src/main/java/org/apache/thrift/transport/TSSLTransportFactory.java b/lib/java/src/main/java/org/apache/thrift/transport/TSSLTransportFactory.java
index 6b0499979..9a08b19b7 100644
--- a/lib/java/src/main/java/org/apache/thrift/transport/TSSLTransportFactory.java
+++ b/lib/java/src/main/java/org/apache/thrift/transport/TSSLTransportFactory.java
@@ -30,6 +30,7 @@ import java.security.KeyStore;
 import java.util.Arrays;
 import javax.net.ssl.KeyManagerFactory;
 import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLParameters;
 import javax.net.ssl.SSLServerSocket;
 import javax.net.ssl.SSLServerSocketFactory;
 import javax.net.ssl.SSLSocket;
@@ -343,6 +344,9 @@ public class TSSLTransportFactory {
     try {
       SSLSocket socket = (SSLSocket) factory.createSocket(host, port);
       socket.setSoTimeout(timeout);
+      SSLParameters sslParams = socket.getSSLParameters();
+      sslParams.setEndpointIdentificationAlgorithm("HTTPS");
+      socket.setSSLParameters(sslParams);
       return new TSocket(socket);
     } catch (TTransportException tte) {
       throw tte;