From 543492b491e337c17d9657e28be059114a4db502 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 6 Aug 2026 09:20:02 +0000 Subject: [PATCH 1/3] Initial plan From 6407a8bc825fe24d3c0d1d88e584f4fd8860b575 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 6 Aug 2026 09:21:49 +0000 Subject: [PATCH 2/3] Replace deprecated qhelp files with Markdown documentation Co-authored-by: carlspring <1436265+carlspring@users.noreply.github.com> --- src/main/ql/InsecureCorsHttpOrigin.md | 129 +++++++++++++++++++ src/main/ql/InsecureCorsHttpOrigin.qhelp | 36 ------ src/main/ql/InsecureCorsWildcardOrigin.md | 127 ++++++++++++++++++ src/main/ql/InsecureCorsWildcardOrigin.qhelp | 39 ------ src/main/ql/InsecureHttpServer.md | 92 +++++++++++++ src/main/ql/InsecureHttpServer.qhelp | 46 ------- 6 files changed, 348 insertions(+), 121 deletions(-) create mode 100644 src/main/ql/InsecureCorsHttpOrigin.md delete mode 100644 src/main/ql/InsecureCorsHttpOrigin.qhelp create mode 100644 src/main/ql/InsecureCorsWildcardOrigin.md delete mode 100644 src/main/ql/InsecureCorsWildcardOrigin.qhelp create mode 100644 src/main/ql/InsecureHttpServer.md delete mode 100644 src/main/ql/InsecureHttpServer.qhelp diff --git a/src/main/ql/InsecureCorsHttpOrigin.md b/src/main/ql/InsecureCorsHttpOrigin.md new file mode 100644 index 0000000..f571c11 --- /dev/null +++ b/src/main/ql/InsecureCorsHttpOrigin.md @@ -0,0 +1,129 @@ +# Insecure CORS HTTP Origin + +## Overview + +An HTTP server with a CORS configuration that allows unsecured HTTP connection is prone to exploits. + +## Recommendation + +Make sure the connection to the origins is established over HTTPS. + +## Example + +Instead of an insecure HTTP connection to the origin, such as in the example below: + +```java +package org.carlspring.security.vertx.http; + +import io.vertx.core.AbstractVerticle; +import io.vertx.core.http.HttpHeaders; +import io.vertx.core.http.HttpMethod; +import io.vertx.ext.web.Router; +import io.vertx.ext.web.handler.CorsHandler; + +public class InsecureCorsHttpOrigin extends AbstractVerticle { + + @Override + public void start() { + // Create a router + Router router = Router.router(vertx); + + // Configure CORS handling with allowed origins, headers, and methods + CorsHandler corsHandler = CorsHandler.create() + // Insecure configuration that doesn't use HTTPS: + .addOrigin("http://example.com") + .allowedHeader(HttpHeaders.CONTENT_TYPE.toString()) + .allowedMethod(HttpMethod.GET) + .allowedMethod(HttpMethod.POST); + + // Mount the CORS handler + router.route().handler(corsHandler); + + // Set up routes + router.get("/api/data").handler(routingContext -> { + routingContext.response() + .putHeader(HttpHeaders.CONTENT_TYPE, "application/json") + .end("{\"message\":\"Hello, CORS!\"}"); + }); + + // Start the server + vertx.createHttpServer() + .requestHandler(router) + .listen(8080, ar -> { + if (ar.succeeded()) { + System.out.println("Server started on port 8080"); + } else { + System.err.println("Server failed to start: " + ar.cause()); + } + }); + } + +} +``` + +Set up SSL like this: + +```java +package org.carlspring.security.vertx.http; + +import io.vertx.core.AbstractVerticle; +import io.vertx.core.http.HttpHeaders; +import io.vertx.core.http.HttpMethod; +import io.vertx.core.http.HttpServerOptions; +import io.vertx.core.net.JksOptions; +import io.vertx.ext.web.Router; +import io.vertx.ext.web.handler.CorsHandler; + +public class SecureCorsServer extends AbstractVerticle { + + @Override + public void start() { + // Create a router + Router router = Router.router(vertx); + + // Configure CORS handling with allowed origins, headers, and methods + CorsHandler corsHandler = CorsHandler.create() + // 1) Use HTTPS + // 2) Use an explicitly defined origin + .addOrigin("https://example.com") + // 3) Define allowed headers + .allowedHeader(HttpHeaders.CONTENT_TYPE.toString()) + // 4) Define allowed methods + .allowedMethod(HttpMethod.GET) + .allowedMethod(HttpMethod.POST); + + // Mount the CORS handler + router.route().handler(corsHandler); + + // Set up routes + router.get("/api/data").handler(routingContext -> { + routingContext.response() + .putHeader(HttpHeaders.CONTENT_TYPE, "application/json") + .end("{\"message\":\"Hello, CORS!\"}"); + }); + + // Set up SSL + HttpServerOptions options = new HttpServerOptions() + .setSsl(true) + .setKeyStoreOptions(new JksOptions().setPath("keystore.jks") + .setPassword("keystore_password")); + + // Start the server + vertx.createHttpServer(options) + .requestHandler(router) + .listen(8080, ar -> { + if (ar.succeeded()) { + System.out.println("Server started on port 8080"); + } else { + System.err.println("Server failed to start: " + ar.cause()); + } + }); + } + +} +``` + +## References + +- [Vert.x documentation](https://vertx.io/docs/vertx-core/java/#_writing_http_servers_and_clients) +- [Exploiting CORS – How to pen-test Cross-Origin Resource Sharing Vulnerabilities](https://www.freecodecamp.org/news/exploiting-cors-guide-to-pentesting/) diff --git a/src/main/ql/InsecureCorsHttpOrigin.qhelp b/src/main/ql/InsecureCorsHttpOrigin.qhelp deleted file mode 100644 index c5c7306..0000000 --- a/src/main/ql/InsecureCorsHttpOrigin.qhelp +++ /dev/null @@ -1,36 +0,0 @@ - - - -

- An HTTP server with a CORS configuration that allows unsecured HTTP connection is prone to exploits. -

- - - -

Make sure the connection to the origins is established over HTTPS.

- - -

Instead of an insecure HTTP connection to the origin, such as in the example below:

- - - -

set up SSL like this:

- - - - - -
  • - - Vert.x documentation - -
    • -
  • - - Exploiting CORS – How to pen-test Cross-Origin Resource Sharing Vulnerabilities - -
    • -     -     diff --git a/src/main/ql/InsecureCorsWildcardOrigin.md b/src/main/ql/InsecureCorsWildcardOrigin.md new file mode 100644 index 0000000..af5d9bf --- /dev/null +++ b/src/main/ql/InsecureCorsWildcardOrigin.md @@ -0,0 +1,127 @@ +# Insecure CORS Wildcard Origin + +## Overview + +An HTTP server with a CORS configuration that allows wildcard origins is insecure, as it allows +connections from any host. + +## Recommendation + +Add explicit origins when configuring the `CorsHandler`. + +## Example + +Instead of adding a wildcard origin, such as in the example below: + +```java +package org.carlspring.security.vertx.http; + +import io.vertx.core.AbstractVerticle; +import io.vertx.core.http.HttpHeaders; +import io.vertx.core.http.HttpMethod; +import io.vertx.ext.web.Router; +import io.vertx.ext.web.handler.CorsHandler; + +public class InsecureCorsWildcardOrigin extends AbstractVerticle { + + @Override + public void start() { + // Create a router + Router router = Router.router(vertx); + + // Allow all origins, headers, and methods (insecure configuration) + CorsHandler corsHandler = CorsHandler.create() + .addOrigin("*") + .allowedHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS.toString()) + .allowedMethod(HttpMethod.GET) + .allowedMethod(HttpMethod.POST); + + // Mount the CORS handler + router.route().handler(corsHandler); + + // Set up routes + router.get("/api/data").handler(routingContext -> { + routingContext.response() + .putHeader(HttpHeaders.CONTENT_TYPE, "application/json") + .end("{\"message\":\"Hello, CORS!\"}"); + }); + + // Start the server + vertx.createHttpServer().requestHandler(router).listen(8080, ar -> { + if (ar.succeeded()) { + System.out.println("Server started on port 8080"); + } else { + System.err.println("Server failed to start: " + ar.cause()); + } + }); + } + +} +``` + +Define the origins explicitly like this: + +```java +package org.carlspring.security.vertx.http; + +import io.vertx.core.AbstractVerticle; +import io.vertx.core.http.HttpHeaders; +import io.vertx.core.http.HttpMethod; +import io.vertx.core.http.HttpServerOptions; +import io.vertx.core.net.JksOptions; +import io.vertx.ext.web.Router; +import io.vertx.ext.web.handler.CorsHandler; + +public class SecureCorsServer extends AbstractVerticle { + + @Override + public void start() { + // Create a router + Router router = Router.router(vertx); + + // Configure CORS handling with allowed origins, headers, and methods + CorsHandler corsHandler = CorsHandler.create() + // 1) Use HTTPS + // 2) Use an explicitly defined origin + .addOrigin("https://example.com") + // 3) Define allowed headers + .allowedHeader(HttpHeaders.CONTENT_TYPE.toString()) + // 4) Define allowed methods + .allowedMethod(HttpMethod.GET) + .allowedMethod(HttpMethod.POST); + + // Mount the CORS handler + router.route().handler(corsHandler); + + // Set up routes + router.get("/api/data").handler(routingContext -> { + routingContext.response() + .putHeader(HttpHeaders.CONTENT_TYPE, "application/json") + .end("{\"message\":\"Hello, CORS!\"}"); + }); + + // Set up SSL + HttpServerOptions options = new HttpServerOptions() + .setSsl(true) + .setKeyStoreOptions(new JksOptions().setPath("keystore.jks") + .setPassword("keystore_password")); + + // Start the server + vertx.createHttpServer(options) + .requestHandler(router) + .listen(8080, ar -> { + if (ar.succeeded()) { + System.out.println("Server started on port 8080"); + } else { + System.err.println("Server failed to start: " + ar.cause()); + } + }); + } + +} +``` + +## References + +- [Vert.x documentation](https://vertx.io/docs/vertx-core/java/#_writing_http_servers_and_clients) +- [Exploiting CORS – How to Pentest Cross-Origin Resource Sharing Vulnerabilities](https://www.freecodecamp.org/news/exploiting-cors-guide-to-pentesting/) diff --git a/src/main/ql/InsecureCorsWildcardOrigin.qhelp b/src/main/ql/InsecureCorsWildcardOrigin.qhelp deleted file mode 100644 index 850f17c..0000000 --- a/src/main/ql/InsecureCorsWildcardOrigin.qhelp +++ /dev/null @@ -1,39 +0,0 @@ - - - -

    - An HTTP server with a CORS configuration that allows wildcard origins is insecure, as it allows connections - from any host. -

    -     - - -

    Add explicit origins when configuring the CorsHandler.

    -     - - -

    Instead of adding a wildcard origin, such as in the example below:

    - - - -

    define the origins explicitly like this:

    - - -     - - -
  • - - Vert.x documentation - -
    • -
  • - - Exploiting CORS – How to Pentest Cross-Origin Resource Sharing Vulnerabilities - -
    • - -     -     diff --git a/src/main/ql/InsecureHttpServer.md b/src/main/ql/InsecureHttpServer.md new file mode 100644 index 0000000..196726d --- /dev/null +++ b/src/main/ql/InsecureHttpServer.md @@ -0,0 +1,92 @@ +# Insecure HTTP Server + +## Overview + +An HTTP server which does not use SSL/TLS is vulnerable to man-in-the-middle attacks. + +Please, note that it may be safe to ignore this, only if you intend your application to be placed +behind a loadbalancer, which is itself securing the connections with the appropriate certificates. + +## Recommendation + +Use SSL/TLS to encrypt the communication between the client and the server. + +## Example + +Instead of setting up a plain HTTP server that doesn't use SSL, such as this one: + +```java +package org.carlspring.security.vertx.http; + +import io.vertx.core.AbstractVerticle; +import io.vertx.core.http.HttpServer; + +public class InsecureHttpServer extends AbstractVerticle { + + @Override + public void start() { + // Create an insecure HTTP server + HttpServer server = vertx.createHttpServer(); + + // Configure server settings + server.requestHandler(request -> { + request.response().end("Hello, World!"); + }); + + // Start the server + server.listen(8080); + } + +} +``` + +When creating an HTTP server, the `setSsl` method should be called on the `HttpServerOptions` object, +and the `setKeyStoreOptions` method should be called on the `HttpServerOptions` object with a +`KeyStoreOptions` object as an argument. + +For example, code such as the one illustrated below should be used to create an HTTP server and secure +it with SSL: + +```java +package org.carlspring.security.vertx.http; + +import io.vertx.core.AbstractVerticle; +import io.vertx.core.http.HttpServer; +import io.vertx.core.http.HttpServerOptions; +import io.vertx.core.http.HttpServerResponse; +import io.vertx.core.net.JksOptions; + +public class SecureHttpServer extends AbstractVerticle { + + @Override + public void start() { + HttpServerOptions options = new HttpServerOptions() + // Set up SSL + .setSsl(true) + // Set up keystore + .setKeyStoreOptions(new JksOptions().setPath("keystore.jks") + .setPassword("keystore_password")); + + HttpServer server = vertx.createHttpServer(options); + + server.requestHandler(request -> { + HttpServerResponse response = request.response(); + response.putHeader("Content-Type", "text/plain"); + response.end("Hello, World! This is a secure connection."); + }); + + server.listen(8443, "localhost", result -> { + if (result.succeeded()) { + System.out.println("Server started on port 8443 with SSL/TLS"); + } else { + System.err.println("Server failed to start: " + result.cause()); + } + }); + } + +} +``` + +## References + +- [Vert.x documentation](https://vertx.io/docs/vertx-core/java/#_writing_http_servers_and_clients) diff --git a/src/main/ql/InsecureHttpServer.qhelp b/src/main/ql/InsecureHttpServer.qhelp deleted file mode 100644 index 553dbca..0000000 --- a/src/main/ql/InsecureHttpServer.qhelp +++ /dev/null @@ -1,46 +0,0 @@ - - - -

    - An HTTP server which does not use SSL/TLS is vulnerable to man-in-the-middle attacks. -

    -

    - Please, note that it may be safe to ignore this, only if you intend your application to be placed - behind a loadbalancer, which is itself securing the connections with the appropriate certificates. -

    -     - - -

    Use SSL/TLS to encrypt the communication between the client and the server.

    -     - - -

    Instead of setting up a plain HTTP server that doesn't use SSL, such as this one:

    - - - -

    - when creating an HTTP server, the setSsl method should be called on the - HttpServerOptions - object, and the setKeyStoreOptions method should be called on the - HttpServerOptions - object with a KeyStoreOptions - object as an argument. - - For example, code such as the one illustrated below should be used to create an HTTP server and secure - it with SSL: -

    - - -     - - -
  • - - Vert.x documentation - -
    • -     -     From fafe8bcb12ddddbdf7df5210833cd8f413876f03 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 6 Aug 2026 09:22:39 +0000 Subject: [PATCH 3/3] Fix secure CORS example to listen on port 8443 instead of 8080 Co-authored-by: carlspring <1436265+carlspring@users.noreply.github.com> --- src/main/ql/InsecureCorsHttpOrigin.md | 4 ++-- src/main/ql/InsecureCorsWildcardOrigin.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/main/ql/InsecureCorsHttpOrigin.md b/src/main/ql/InsecureCorsHttpOrigin.md index f571c11..a097373 100644 --- a/src/main/ql/InsecureCorsHttpOrigin.md +++ b/src/main/ql/InsecureCorsHttpOrigin.md @@ -111,9 +111,9 @@ public class SecureCorsServer extends AbstractVerticle { // Start the server vertx.createHttpServer(options) .requestHandler(router) - .listen(8080, ar -> { + .listen(8443, ar -> { if (ar.succeeded()) { - System.out.println("Server started on port 8080"); + System.out.println("Server started on port 8443"); } else { System.err.println("Server failed to start: " + ar.cause()); } diff --git a/src/main/ql/InsecureCorsWildcardOrigin.md b/src/main/ql/InsecureCorsWildcardOrigin.md index af5d9bf..9e383b0 100644 --- a/src/main/ql/InsecureCorsWildcardOrigin.md +++ b/src/main/ql/InsecureCorsWildcardOrigin.md @@ -109,9 +109,9 @@ public class SecureCorsServer extends AbstractVerticle { // Start the server vertx.createHttpServer(options) .requestHandler(router) - .listen(8080, ar -> { + .listen(8443, ar -> { if (ar.succeeded()) { - System.out.println("Server started on port 8080"); + System.out.println("Server started on port 8443"); } else { System.err.println("Server failed to start: " + ar.cause()); }