logo

Database

Java Deprecated Default Http Client Used

Description

Detects usage of Apache's deprecated DefaultHttpClient class which has known security vulnerabilities including weak SSL/TLS configuration defaults. Using this client can expose applications to man-in-the-middle attacks and other security issues.

Weakness:

016 - Insecure encryption algorithm - SSL/TLS

Category: Information Collection

Detection Strategy

    • Check if code imports from the org.apache.http.impl.client package

    • Look for instantiations or references to the 'DefaultHttpClient' class name

    • Report vulnerability when DefaultHttpClient is used instead of recommended alternatives like HttpClientBuilder or CloseableHttpClient

Vulnerable code example

import org.apache.http.client.HttpClient;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.DefaultHttpClient;

public class Crawler {
    public void fetch(String url) throws Exception {
        HttpClient client = new DefaultHttpClient();  // Vulnerable: Uses deprecated client with security issues
        HttpGet request = new HttpGet(url);...

✅ Secure code example

import org.apache.http.impl.client.HttpClients;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.client.methods.HttpGet;

public class Crawler {
    public void fetch(String url) throws Exception {
        try (CloseableHttpClient client = HttpClients.createDefault()) {  // Safe: Uses modern HTTP client with auto-closing
            HttpGet request = new HttpGet(url);...