Add CodeQL suppression (#2255)

microsoft · Nov 16, 2023 · 0d6dae9 · 0d6dae9
1 parent 09ae6b8
commit 0d6dae9
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/src/main/java/com/microsoft/sqlserver/jdbc/IOBuffer.java b/src/main/java/com/microsoft/sqlserver/jdbc/IOBuffer.java
@@ -1812,7 +1812,9 @@ else if (con.getTrustManagerClass() != null) {
             if (logger.isLoggable(Level.FINEST))
                 logger.finest(toString() + " Initializing SSL context");
 
-            sslContext.init(km, tm, null);
+            sslContext.init(km, tm, null); // CodeQL [SM03853] Potential all-accepting TrustManager is by design
+            // Permissive trust manager allows minimum encryption of credentials even when trusted certificates
+            // aren't provisioned on the server.
 
             // Got the SSL context. Now create an SSL socket over our own proxy socket
             // which we can toggle between TDS-encapsulated and raw communications.