Fix three CodeQL code scanning alerts: insecure hostname verification and XXE

[Copilot]

Resolves three open CodeQL code scanning alerts across the SOAP and REST client modules.

CWE-297: Insecure hostname verification (2 alerts)

• SOAP (MssServiceFactory.java): Removed custom NoopHostnameVerifier inner class whose verify() unconditionally returned true. Removed the associated JAXWS_HOSTNAME_VERIFIER constant.
• REST (ComProtocolHandlerRestImpl.java): Removed usage of Apache's NoopHostnameVerifier.INSTANCE when constructing SSLConnectionSocketFactory. Removed unused import.

Both paths now always use the default secure hostname verifier. When the config flag isHostnameVerification() is false, a warning is logged indicating the setting is ignored.

CWE-611: XXE via TransformerFactory (1 alert)

• SOAP (SoapTrafficHandler.java): Hardened TransformerFactory used for SOAP message pretty-printing:

TransformerFactory tff = TransformerFactory.newInstance();
tff.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
tff.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/MobileID-Strong-Authentication/mobileid-client-java/code-scanning/alerts
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud