CWE-295: TrustAny.java — Public Utility Class that Trusts All Certificates and Hostnames

[LeoWSY-hashblue]

Summary

SMQ ships TrustAny.java, a public utility class providing TrustManager (trusts all certs) and HostnameVerifier (accepts all hostnames). Intended for development but available as public API.

Vulnerable Code (Java/RTL/SMQ/TrustAny.java)

static public TrustManager[] cert() // trusts everything
static public HostnameVerifier hostName() // returns true always

Impact

Any SMQ client calling TrustAny.cert() or TrustAny.hostName() gets zero TLS security.

Fix

Remove from public API or gate behind explicit dev-mode flag.

Severity

CVSS 7.4 (HIGH) — CWE-295