Add spurious test case

atorralba · atorralba · commit 7c28ce665520 · 2021-06-28T14:36:27.000+02:00
diff --git a/java/ql/test/query-tests/security/CWE-273/UnsafeCertTrustTest.java b/java/ql/test/query-tests/security/CWE-273/UnsafeCertTrustTest.java
@@ -191,12 +191,23 @@ public void testSSLSocketEndpointIdSafeWithConditionalSanitizer(boolean safe) th
 		SSLSocket socket = (SSLSocket) socketFactory.createSocket();
 		if (safe) {
 			SSLParameters sslParameters = socket.getSSLParameters();
-			onSetSSLParameters(sslParameters);
+			sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
 			socket.setSSLParameters(sslParameters);
 		}
 		socket.getOutputStream(); // Safe
 	}
 
+	public void testSSLSocketEndpointIdSafeWithSanitizerInCast(boolean safe) throws Exception {
+		SSLContext sslContext = SSLContext.getInstance("TLS");
+		SSLSocketFactory socketFactory = sslContext.getSocketFactory();
+		Socket socket = socketFactory.createSocket();
+		SSLSocket sslSocket = (SSLSocket) socket;
+		SSLParameters sslParameters = sslSocket.getSSLParameters();
+		sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
+		sslSocket.setSSLParameters(sslParameters);
+		socket.getOutputStream(); // $ SPURIOUS: hasUnsafeCertTrust
+	}
+
 	public void testSocketEndpointIdNotSet() throws Exception {
 		SocketFactory socketFactory = SocketFactory.getDefault();
 		Socket socket = socketFactory.createSocket("www.example.com", 80);
