From 4903d3ee50bf3fceb174d7b3eb65894404d6923b Mon Sep 17 00:00:00 2001
From: RinZ27 <222222878+RinZ27@users.noreply.github.com>
Date: Sun, 24 May 2026 19:32:06 +0700
Subject: [PATCH] security(network): enforce secure-by-default SSL validation
 in SSLFactory

---
 .../apache/spark/network/ssl/SSLFactory.java  | 29 +++++--------------
 .../spark/network/ssl/SSLFactorySuite.java    | 10 +++++++
 2 files changed, 17 insertions(+), 22 deletions(-)

diff --git a/common/network-common/src/main/java/org/apache/spark/network/ssl/SSLFactory.java b/common/network-common/src/main/java/org/apache/spark/network/ssl/SSLFactory.java
index f4b245ca7b128..2bee832e5aa70 100644
--- a/common/network-common/src/main/java/org/apache/spark/network/ssl/SSLFactory.java
+++ b/common/network-common/src/main/java/org/apache/spark/network/ssl/SSLFactory.java
@@ -338,32 +338,11 @@ private SSLEngine createEngine(boolean isClient, ByteBufAllocator allocator) {
     return engine;
   }
 
-  private static TrustManager[] credulousTrustStoreManagers() {
-    return new TrustManager[]{new X509TrustManager() {
-      @Override
-      public void checkClientTrusted(X509Certificate[] x509Certificates, String s)
-        throws CertificateException {
-      }
-
-      @Override
-      public void checkServerTrusted(X509Certificate[] x509Certificates, String s)
-        throws CertificateException {
-      }
-
-      @Override
-      public X509Certificate[] getAcceptedIssuers() {
-        return null;
-      }
-    }};
-  }
-
   private static TrustManager[] trustStoreManagers(
       File trustStore, String trustStorePassword,
       boolean trustStoreReloadingEnabled, int trustStoreReloadIntervalMs)
           throws IOException, GeneralSecurityException {
-    if (trustStore == null || !trustStore.exists()) {
-      return credulousTrustStoreManagers();
-    } else {
+    if (trustStore != null && trustStore.exists()) {
       if (trustStoreReloadingEnabled) {
         ReloadingX509TrustManager reloading = new ReloadingX509TrustManager(
           KeyStore.getDefaultType(), trustStore, trustStorePassword, trustStoreReloadIntervalMs);
@@ -372,6 +351,12 @@ private static TrustManager[] trustStoreManagers(
       } else {
         return defaultTrustManagers(trustStore, trustStorePassword);
       }
+    } else {
+      // Use the system default TrustManager instead of a "trust-all" implementation
+      TrustManagerFactory tmf = TrustManagerFactory.getInstance(
+        TrustManagerFactory.getDefaultAlgorithm());
+      tmf.init((KeyStore) null);
+      return tmf.getTrustManagers();
     }
   }
 
diff --git a/common/network-common/src/test/java/org/apache/spark/network/ssl/SSLFactorySuite.java b/common/network-common/src/test/java/org/apache/spark/network/ssl/SSLFactorySuite.java
index 922d0f22c25c6..c787d186c2c89 100644
--- a/common/network-common/src/test/java/org/apache/spark/network/ssl/SSLFactorySuite.java
+++ b/common/network-common/src/test/java/org/apache/spark/network/ssl/SSLFactorySuite.java
@@ -101,4 +101,14 @@ public void testKeyAndKeystorePasswordsAreDistinct() throws Exception {
       factory.createSSLEngine(true, ByteBufAllocator.DEFAULT);
     });
   }
+
+  @Test
+  public void testBuildWithoutTrustStoreUsesSystemDefault() throws Exception {
+    // Should not throw exception and should not use credulous managers
+    SSLFactory factory = new SSLFactory.Builder()
+      .requestedProtocol("TLSv1.3")
+      .keyStore(new File(SslSampleConfigs.keyStorePath), "password")
+      .build();
+    assertNotNull(factory.createSSLEngine(true, ByteBufAllocator.DEFAULT));
+  }
 }