CVE-2021-32700: Missing Authentication for Critical Function (CWE-306)
value: Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up to alpha 3 have a potential for a supply chain attack via MiTM against users. Http connections did not make use of TLS and certificate checking was ignored. The vulnerability allows an attacker to substitute or modify packages retrieved from BC thus allowing to inject malicious code into ballerina executables. This has been patched in Ballerina 1.2.14 and Ballerina SwanLake alpha4.
CWE description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CVSS v3 base score: 7.4
Published: 2021-06-22T20:15Z
Repository: https://github.com/ballerina-platform/ballerina-lang
Language: Java
Files changed: cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Pull.java, cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Push.java, cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Search.java, cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/TokenUpdater.java, cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/util/Utils.java, cli/ballerina-cli-module/src/test/java/org/ballerinalang/cli/module/UtilsTest.java, compiler/ballerina-lang/src/main/java/org/wso2/ballerinalang/compiler/packaging/converters/URIDryConverter.java, misc/openapi-ballerina/modules/openapi-to-ballerina-generator/src/main/java/org/ballerinalang/openapi/CodeGenerator.java, tests/jballerina-integration-test/src/test/java/org/ballerinalang/test/packaging/PackagingTestCase.java
Commit date: 2021-03-16 18:31:13 +0530
Commit message: Fix central connection

Diff: diff --git a/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Pull.java b/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Pull.java
index 74909654992..856b87df82d 100644
--- a/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Pull.java
+++ b/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Pull.java
@@ -28,26 +28,25 @@ import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.io.PrintStream;
 import java.net.Authenticator;
-import java.net.HttpURLConnection;
 import java.nio.charset.Charset;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 
+import javax.net.ssl.HttpsURLConnection;
 import javax.ws.rs.core.HttpHeaders;
 
 import static org.ballerinalang.cli.module.util.CliModuleConstants.BALLERINA_PLATFORM;
 import static org.ballerinalang.cli.module.util.CliModuleConstants.BAL_LANG_SPEC_VERSION;
 import static org.ballerinalang.cli.module.util.CliModuleConstants.IDENTITY;
 import static org.ballerinalang.cli.module.util.CliModuleConstants.RESOLVED_REQUESTED_URI;
 import static org.ballerinalang.cli.module.util.Utils.convertToUrl;
-import static org.ballerinalang.cli.module.util.Utils.createHttpUrlConnection;
+import static org.ballerinalang.cli.module.util.Utils.createHttpsUrlConnection;
 import static org.ballerinalang.cli.module.util.Utils.getStatusCode;
-import static org.ballerinalang.cli.module.util.Utils.initializeSsl;
 import static org.ballerinalang.cli.module.util.Utils.setRequestMethod;
 
 /**
  * This class is pulling the modules from ballerina central.
  *
@@ -82,15 +81,14 @@ public class Pull {
             boolean isNightlyBuild, String langSpecVersion, String platform) {
         if (isBuild) {
             logFormatter = new BuildLogFormatter();
         }
 
-        HttpURLConnection conn = null;
+        HttpsURLConnection conn = null;
         try {
-            initializeSsl();
-            conn = createHttpUrlConnection(convertToUrl(url + supportedVersionRange), proxyHost, proxyPort,
-                    proxyUsername, proxyPassword);
+            conn = createHttpsUrlConnection(convertToUrl(url + supportedVersionRange), proxyHost, proxyPort,
+                                            proxyUsername, proxyPassword);
 
             conn.setInstanceFollowRedirects(false);
             setRequestMethod(conn, Utils.RequestMethod.GET);
 
             // Set headers
@@ -99,23 +97,23 @@ public class Pull {
             conn.setRequestProperty(HttpHeaders.ACCEPT_ENCODING, IDENTITY);
 
             boolean redirect = false;
             // 302 - Module is found
             // Other - Error occurred, json returned with the error message
-            if (getStatusCode(conn) == HttpURLConnection.HTTP_MOVED_TEMP) {
+            if (getStatusCode(conn) == HttpsURLConnection.HTTP_MOVED_TEMP) {
                 redirect = true;
             } else {
                 handleErrorResponse(conn, url, moduleNameWithOrg);
             }
 
             if (redirect) {
                 // get redirect url from "location" header field
                 String newUrl = conn.getHeaderField(HttpHeaders.LOCATION);
                 String contentDisposition = conn.getHeaderField(HttpHeaders.CONTENT_DISPOSITION);
 
-                conn = createHttpUrlConnection(convertToUrl(newUrl), proxyHost, proxyPort, proxyUsername,
-                        proxyPassword);
+                conn = createHttpsUrlConnection(convertToUrl(newUrl), proxyHost, proxyPort, proxyUsername,
+                                                proxyPassword);
                 conn.setRequestProperty(HttpHeaders.CONTENT_DISPOSITION, contentDisposition);
 
                 createBaloInHomeRepo(conn, modulePathInBaloCache, moduleNameWithOrg, isNightlyBuild, newUrl,
                         contentDisposition);
             }
@@ -130,18 +128,18 @@ public class Pull {
     }
 
     /**
      * Create the balo in home repo.
      *
-     * @param conn                  http connection
+     * @param conn                  https connection
      * @param modulePathInBaloCache module path in balo cache, <user.home>.ballerina/balo_cache/<org-name>/<module-name>
      * @param moduleNameWithOrg     module name with org, <org-name>/<module-name>
      * @param isNightlyBuild        is nightly build
      * @param newUrl                new redirect url
      * @param contentDisposition    content disposition header
      */
-    private static void createBaloInHomeRepo(HttpURLConnection conn, String modulePathInBaloCache,
+    private static void createBaloInHomeRepo(HttpsURLConnection conn, String modulePathInBaloCache,
             String moduleNameWithOrg, boolean isNightlyBuild, String newUrl, String contentDisposition) {
         long responseContentLength = conn.getContentLengthLong();
         if (responseContentLength <= 0) {
             createError("invalid response from the server, please try again");
         }
@@ -168,16 +166,16 @@ public class Pull {
     }
 
     /**
      * Write balo file to the home repo.
      *
-     * @param conn             http connection
+     * @param conn             https connection
      * @param baloPath         path of the balo file
      * @param fullModuleName   full module name, <org-name>/<module-name>:<module-version>
      * @param resContentLength response content length
      */
-    private static void writeBaloFile(HttpURLConnection conn, Path baloPath, String fullModuleName,
+    private static void writeBaloFile(HttpsURLConnection conn, Path baloPath, String fullModuleName,
             long resContentLength) {
         try (InputStream inputStream = conn.getInputStream();
                 FileOutputStream outputStream = new FileOutputStream(baloPath.toString())) {
             writeAndHandleProgress(inputStream, outputStream, resContentLength / 1024, fullModuleName);
         } catch (IOException e) {
@@ -266,15 +264,15 @@ public class Pull {
     }
 
     /**
      * Handle error response.
      *
-     * @param conn           http connection
+     * @param conn           https connection
      * @param url            remote repository url
      * @param moduleFullName module name with org and version
      */
-    private static void handleErrorResponse(HttpURLConnection conn, String url, String moduleFullName) {
+    private static void handleErrorResponse(HttpsURLConnection conn, String url, String moduleFullName) {
         try (BufferedReader reader = new BufferedReader(
                 new InputStreamReader(conn.getErrorStream(), Charset.defaultCharset()))) {
             StringBuilder result = new StringBuilder();
             String line;
             while ((line = reader.readLine()) != null) {
diff --git a/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Push.java b/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Push.java
index bb85319bf49..adc3def5e7e 100644
--- a/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Push.java
+++ b/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Push.java
@@ -28,23 +28,22 @@ import java.io.DataOutputStream;
 import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.io.PrintStream;
 import java.net.Authenticator;
-import java.net.HttpURLConnection;
 import java.nio.charset.Charset;
 import java.nio.file.Files;
 import java.nio.file.Path;
 
+import javax.net.ssl.HttpsURLConnection;
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MediaType;
 
 import static org.ballerinalang.cli.module.util.CliModuleConstants.PUSH_ORGANIZATION;
 import static org.ballerinalang.cli.module.util.Utils.convertToUrl;
-import static org.ballerinalang.cli.module.util.Utils.createHttpUrlConnection;
+import static org.ballerinalang.cli.module.util.Utils.createHttpsUrlConnection;
 import static org.ballerinalang.cli.module.util.Utils.getStatusCode;
-import static org.ballerinalang.cli.module.util.Utils.initializeSsl;
 import static org.ballerinalang.cli.module.util.Utils.setRequestMethod;
 
 /**
  * This class is pushing the modules to ballerina central.
  *
@@ -74,13 +73,12 @@ public class Push {
      * @param version       module version
      * @param baloPath      path to the balo
      */
     public static void execute(String url, String proxyHost, int proxyPort, String proxyUsername, String proxyPassword,
             String accessToken, String orgName, String moduleName, String version, Path baloPath) {
-        initializeSsl();
-        HttpURLConnection conn = createHttpUrlConnection(convertToUrl(url), proxyHost, proxyPort, proxyUsername,
-                proxyPassword);
+        HttpsURLConnection conn = createHttpsUrlConnection(convertToUrl(url), proxyHost, proxyPort, proxyUsername,
+                                                           proxyPassword);
         conn.setInstanceFollowRedirects(false);
         setRequestMethod(conn, Utils.RequestMethod.POST);
 
         // Set headers
         conn.setRequestProperty(HttpHeaders.AUTHORIZATION, "Bearer " + accessToken);
@@ -113,25 +111,25 @@ public class Push {
     }
 
     /**
      * Handle the http response.
      *
-     * @param conn       http connection
+     * @param conn       https connection
      * @param orgName    org name
      * @param moduleName module name
      * @param version    module version
      */
-    private static void handleResponse(HttpURLConnection conn, String orgName, String moduleName, String version) {
+    private static void handleResponse(HttpsURLConnection conn, String orgName, String moduleName, String version) {
         try {
             int statusCode = getStatusCode(conn);
             // 200 - Module pushed successfully
             // Other - Error occurred, json returned with the error message
-            if (statusCode == HttpURLConnection.HTTP_OK) {
+            if (statusCode == HttpsURLConnection.HTTP_OK) {
                 outStream.println(orgName + "/" + moduleName + ":" + version + " pushed to central successfully");
-            } else if (statusCode == HttpURLConnection.HTTP_UNAUTHORIZED) {
+            } else if (statusCode == HttpsURLConnection.HTTP_UNAUTHORIZED) {
                 errStream.println("unauthorized access token for organization: " + orgName);
-            } else if (statusCode == HttpURLConnection.HTTP_BAD_REQUEST) {
+            } else if (statusCode == HttpsURLConnection.HTTP_BAD_REQUEST) {
                 try (BufferedReader reader = new BufferedReader(
                         new InputStreamReader(conn.getErrorStream(), Charset.defaultCharset()))) {
                     StringBuilder result = new StringBuilder();
                     String line;
                     while ((line = reader.readLine()) != null) {
diff --git a/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Search.java b/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Search.java
index cd96cc0b6d7..1dfa0ec296f 100644
--- a/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Search.java
+++ b/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/Search.java
@@ -25,20 +25,20 @@ import org.ballerinalang.jvm.values.MapValue;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.io.PrintStream;
 import java.net.Authenticator;
-import java.net.HttpURLConnection;
 import java.nio.charset.Charset;
 import java.text.DateFormat;
 import java.text.SimpleDateFormat;
 import java.util.Date;
 
+import javax.net.ssl.HttpsURLConnection;
+
 import static org.ballerinalang.cli.module.util.Utils.convertToUrl;
-import static org.ballerinalang.cli.module.util.Utils.createHttpUrlConnection;
+import static org.ballerinalang.cli.module.util.Utils.createHttpsUrlConnection;
 import static org.ballerinalang.cli.module.util.Utils.getStatusCode;
-import static org.ballerinalang.cli.module.util.Utils.initializeSsl;
 import static org.ballerinalang.cli.module.util.Utils.setRequestMethod;
 
 /**
  * This class is searching modules from ballerina central.
  *
@@ -61,32 +61,31 @@ public class Search {
      * @param proxyPassword proxy password
      * @param terminalWidth terminal width of the CLI
      */
     public static void execute(String url, String proxyHost, int proxyPort, String proxyUsername, String proxyPassword,
             String terminalWidth) {
-        initializeSsl();
-        HttpURLConnection conn = createHttpUrlConnection(convertToUrl(url), proxyHost, proxyPort, proxyUsername,
-                proxyPassword);
+        HttpsURLConnection conn = createHttpsUrlConnection(convertToUrl(url), proxyHost, proxyPort, proxyUsername,
+                                                           proxyPassword);
         conn.setInstanceFollowRedirects(false);
         setRequestMethod(conn, Utils.RequestMethod.GET);
         handleResponse(conn, getStatusCode(conn), terminalWidth);
         Authenticator.setDefault(null);
     }
 
     /**
      * Handle http response.
      *
-     * @param conn          http connection
+     * @param conn          https connection
      * @param statusCode    status code of the response
      * @param terminalWidth terminal width of the CLI
      */
-    private static void handleResponse(HttpURLConnection conn, int statusCode, String terminalWidth) {
+    private static void handleResponse(HttpsURLConnection conn, int statusCode, String terminalWidth) {
         try {
             // 200 - modules found
             // Other - Error occurred, json returned with the error message
             MapValue payload;
-            if (statusCode == HttpURLConnection.HTTP_OK) {
+            if (statusCode == HttpsURLConnection.HTTP_OK) {
                 try (BufferedReader reader = new BufferedReader(
                         new InputStreamReader(conn.getInputStream(), Charset.defaultCharset()))) {
                     StringBuilder result = new StringBuilder();
                     String line;
                     while ((line = reader.readLine()) != null) {
diff --git a/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/TokenUpdater.java b/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/TokenUpdater.java
index cc9d3bd937b..6b350ab72e7 100644
--- a/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/TokenUpdater.java
+++ b/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/TokenUpdater.java
@@ -24,16 +24,16 @@ import org.ballerinalang.cli.module.util.ErrorUtil;
 import java.io.FileNotFoundException;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
 import java.io.PrintStream;
-import java.net.HttpURLConnection;
 import java.net.InetSocketAddress;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Paths;
 import java.util.Collections;
 
+import javax.net.ssl.HttpsURLConnection;
 import javax.ws.rs.core.HttpHeaders;
 
 import static org.ballerinalang.cli.module.util.CliModuleConstants.SETTINGS_TOML_FILE;
 
 /**
@@ -102,12 +102,12 @@ public class TokenUpdater {
             OutputStream os = null;
             try {
                 String response = "<svg xmlns=\"http://www.w3.org/2000/svg\"/>";
                 httpExchange.getResponseHeaders()
                         .put(HttpHeaders.CONTENT_TYPE, Collections.singletonList("image/svg+xml"));
-                httpExchange.sendResponseHeaders(HttpURLConnection.HTTP_OK,
-                        response.getBytes(StandardCharsets.UTF_8).length);
+                httpExchange.sendResponseHeaders(HttpsURLConnection.HTTP_OK,
+                                                 response.getBytes(StandardCharsets.UTF_8).length);
                 os = httpExchange.getResponseBody();
                 os.write(response.getBytes(StandardCharsets.UTF_8));
             } catch (IOException e) {
                 throw ErrorUtil
                         .createCommandException("error occurred while generating the response: " + e.getMessage());
diff --git a/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/util/Utils.java b/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/util/Utils.java
index d2f35b2293f..934ccbc2cef 100644
--- a/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/util/Utils.java
+++ b/cli/ballerina-cli-module/src/main/java/org/ballerinalang/cli/module/util/Utils.java
@@ -16,26 +16,18 @@
 
 package org.ballerinalang.cli.module.util;
 
 import java.io.IOException;
 import java.net.Authenticator;
-import java.net.HttpURLConnection;
 import java.net.InetSocketAddress;
 import java.net.MalformedURLException;
 import java.net.PasswordAuthentication;
 import java.net.ProtocolException;
 import java.net.Proxy;
 import java.net.URL;
-import java.security.KeyManagementException;
-import java.security.NoSuchAlgorithmException;
 
 import javax.net.ssl.HttpsURLConnection;
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.TrustManager;
-import javax.net.ssl.X509TrustManager;
-
-import static org.ballerinalang.cli.module.util.CliModuleConstants.SSL;
 
 /**
  * Class contains miscellaneous utility methods.
  *
  * @since 1.2.0
@@ -47,24 +39,10 @@ public class Utils {
      */
     public enum RequestMethod {
         GET, POST
     }
 
-    private static TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
-        public java.security.cert.X509Certificate[] getAcceptedIssuers() {
-            return new java.security.cert.X509Certificate[] {};
-        }
-
-        public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType) {
-            //No need to implement.
-        }
-
-        public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) {
-            //No need to implement.
-        }
-    } };
-
     /**
      * Get proxy for http connection.
      *
      * @param proxyHost     proxy host
      * @param proxyPort     proxy port
@@ -101,54 +79,41 @@ public class Utils {
             throw ErrorUtil.createCommandException(e.getMessage());
         }
     }
 
     /**
-     * Initialize SSL.
-     */
-    public static void initializeSsl() {
-        try {
-            SSLContext sc = SSLContext.getInstance(SSL);
-            sc.init(null, trustAllCerts, new java.security.SecureRandom());
-            HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
-        } catch (NoSuchAlgorithmException | KeyManagementException e) {
-            throw ErrorUtil.createCommandException("initializing SSL failed: " + e.getMessage());
-        }
-    }
-
-    /**
-     * Create http URL connection.
+     * Create https URL connection.
      *
      * @param url           connection URL
      * @param proxyHost     proxy host
      * @param proxyPort     proxy port
      * @param proxyUsername proxy username
      * @param proxyPassword proxy password
      * @return http URL connection
      */
-    public static HttpURLConnection createHttpUrlConnection(URL url, String proxyHost, int proxyPort,
+    public static HttpsURLConnection createHttpsUrlConnection(URL url, String proxyHost, int proxyPort,
             String proxyUsername, String proxyPassword) {
         try {
             Proxy proxy = getProxy(proxyHost, proxyPort, proxyUsername, proxyPassword);
             // set proxy if exists.
             if (proxy == null) {
-                return (HttpURLConnection) url.openConnection();
+                return (HttpsURLConnection) url.openConnection();
             } else {
-                return (HttpURLConnection) url.openConnection(proxy);
+                return (HttpsURLConnection) url.openConnection(proxy);
             }
         } catch (IOException e) {
             throw ErrorUtil.createCommandException(e.getMessage());
         }
     }
 
     /**
      * Set request method of the http connection.
      *
-     * @param conn   http connection
+     * @param conn   https connection
      * @param method request method
      */
-    public static void setRequestMethod(HttpURLConnection conn, RequestMethod method) {
+    public static void setRequestMethod(HttpsURLConnection conn, RequestMethod method) {
         try {
             conn.setRequestMethod(getRequestMethodAsString(method));
         } catch (ProtocolException e) {
             throw ErrorUtil.createCommandException(e.getMessage());
         }
@@ -166,14 +131,14 @@ public class Utils {
     }
 
     /**
      * Get status code of http response.
      *
-     * @param conn http connection
+     * @param conn https connection
      * @return status code
      */
-    public static int getStatusCode(HttpURLConnection conn) {
+    public static int getStatusCode(HttpsURLConnection conn) {
         try {
             return conn.getResponseCode();
         } catch (IOException e) {
             throw ErrorUtil
                     .createCommandException("connection to the remote repository host failed: " + e.getMessage());
diff --git a/cli/ballerina-cli-module/src/test/java/org/ballerinalang/cli/module/UtilsTest.java b/cli/ballerina-cli-module/src/test/java/org/ballerinalang/cli/module/UtilsTest.java
index f09194f81eb..536857d4a6c 100644
--- a/cli/ballerina-cli-module/src/test/java/org/ballerinalang/cli/module/UtilsTest.java
+++ b/cli/ballerina-cli-module/src/test/java/org/ballerinalang/cli/module/UtilsTest.java
@@ -20,15 +20,16 @@ package org.ballerinalang.cli.module;
 
 import org.ballerinalang.cli.module.util.Utils;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-import java.net.HttpURLConnection;
 import java.net.Proxy;
 
+import javax.net.ssl.HttpsURLConnection;
+
 import static org.ballerinalang.cli.module.util.Utils.convertToUrl;
-import static org.ballerinalang.cli.module.util.Utils.createHttpUrlConnection;
+import static org.ballerinalang.cli.module.util.Utils.createHttpsUrlConnection;
 
 /**
  * Unit tests for Utils class.
  *
  * @since 1.2.0
@@ -48,24 +49,24 @@ public class UtilsTest {
         Assert.assertNotNull(proxy);
         Assert.assertEquals(proxy.toString(), "HTTP @ http://localhost:9090");
 
     }
 
-    @Test(description = "Test create http URL connection without proxy")
+    @Test(description = "Test create https URL connection without proxy")
     public void testCreateHttpUrlConnection() {
-        HttpURLConnection conn;
+        HttpsURLConnection conn;
         // Test without proxy
-        conn = createHttpUrlConnection(convertToUrl(TEST_URL), "", 0, "", "");
+        conn = createHttpsUrlConnection(convertToUrl(TEST_URL), "", 0, "", "");
         Assert.assertNotNull(conn);
         // Test with the proxy
-        conn = createHttpUrlConnection(convertToUrl(TEST_URL), "http://localhost", 9090, "testUser", "testPassword");
+        conn = createHttpsUrlConnection(convertToUrl(TEST_URL), "http://localhost", 9090, "testUser", "testPassword");
         Assert.assertNotNull(conn);
     }
 
     @Test(description = "Test set request")
     public void testSetRequestMethod() {
-        HttpURLConnection conn = createHttpUrlConnection(convertToUrl(TEST_URL), "", 0, "", "");
+        HttpsURLConnection conn = createHttpsUrlConnection(convertToUrl(TEST_URL), "", 0, "", "");
         Utils.setRequestMethod(conn, Utils.RequestMethod.POST);
         Assert.assertEquals(conn.getRequestMethod(), "POST");
     }
 
 
diff --git a/compiler/ballerina-lang/src/main/java/org/wso2/ballerinalang/compiler/packaging/converters/URIDryConverter.java b/compiler/ballerina-lang/src/main/java/org/wso2/ballerinalang/compiler/packaging/converters/URIDryConverter.java
index f46c1f04041..6218af0e3be 100644
--- a/compiler/ballerina-lang/src/main/java/org/wso2/ballerinalang/compiler/packaging/converters/URIDryConverter.java
+++ b/compiler/ballerina-lang/src/main/java/org/wso2/ballerinalang/compiler/packaging/converters/URIDryConverter.java
@@ -29,28 +29,22 @@ import org.wso2.ballerinalang.util.TomlParserUtils;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.io.PrintStream;
 import java.net.Authenticator;
-import java.net.HttpURLConnection;
 import java.net.InetSocketAddress;
 import java.net.PasswordAuthentication;
 import java.net.Proxy;
 import java.net.URI;
 import java.nio.charset.Charset;
-import java.security.KeyManagementException;
-import java.security.NoSuchAlgorithmException;
 import java.util.Map;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
 import javax.net.ssl.HttpsURLConnection;
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.TrustManager;
-import javax.net.ssl.X509TrustManager;
 
 /**
  *  Checks if there is a latest version in central if version is not mentioned. If there is then the version of the
  *  module is updated with that version.
  */
@@ -62,53 +56,32 @@ public class URIDryConverter extends URIConverter {
     private static boolean loggedError = false;
     private static final Pattern semVerPatchPattern = Pattern.compile("(\\d+)\\.(\\d+)");
     private PrintStream errStream = System.err;
     private Proxy proxy;
 
-    private static TrustManager[] trustAllCerts = new TrustManager[]{
-            new X509TrustManager() {
-                public java.security.cert.X509Certificate[] getAcceptedIssuers() {
-                    return new java.security.cert.X509Certificate[]{};
-                }
-                public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType) {
-                    //No need to implement.
-                }
-                public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) {
-                    //No need to implement.
-                }
-            }
-    };
-
     public URIDryConverter(URI base, Map<PackageID, Manifest> dependencyManifests) {
         this(base, dependencyManifests, false);
     }
 
     public URIDryConverter(URI base, Map<PackageID, Manifest> dependencyManifests, boolean isBuild) {
         super(base, dependencyManifests, isBuild);
         this.base = URI.create(base.toString() + "/modules/info/");
-        try {
-            SSLContext sc = SSLContext.getInstance("SSL");
-            sc.init(null, trustAllCerts, new java.security.SecureRandom());
-            HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
-            proxy = getProxy();
-        } catch (NoSuchAlgorithmException | KeyManagementException e) {
-            // ignore errors
-        }
+        proxy = getProxy();
     }
 
     public Stream<CompilerInput> finalize(URI remoteURI, PackageID moduleID) {
         try {
             // only continue if a fixed module version is not set. a module version may be set through Ballerina.toml or
             // Ballerina.lock already.
             Matcher matcher = semVerPatchPattern.matcher(moduleID.version.value);
             if ("".equals(moduleID.version.value) || "*".equals(moduleID.version.value) || matcher.matches()) {
-                HttpURLConnection conn;
+                HttpsURLConnection conn;
                 // set proxy if exists.
                 if (null == this.proxy) {
-                    conn = (HttpURLConnection) remoteURI.toURL().openConnection();
+                    conn = (HttpsURLConnection) remoteURI.toURL().openConnection();
                 } else {
-                    conn = (HttpURLConnection) remoteURI.toURL().openConnection(this.proxy);
+                    conn = (HttpsURLConnection) remoteURI.toURL().openConnection(this.proxy);
                 }
                 conn.setInstanceFollowRedirects(false);
                 conn.setRequestMethod("GET");
 
                 // status code and meaning
diff --git a/misc/openapi-ballerina/modules/openapi-to-ballerina-generator/src/main/java/org/ballerinalang/openapi/CodeGenerator.java b/misc/openapi-ballerina/modules/openapi-to-ballerina-generator/src/main/java/org/ballerinalang/openapi/CodeGenerator.java
index 9242650bccf..73321a5b84e 100644
--- a/misc/openapi-ballerina/modules/openapi-to-ballerina-generator/src/main/java/org/ballerinalang/openapi/CodeGenerator.java
+++ b/misc/openapi-ballerina/modules/openapi-to-ballerina-generator/src/main/java/org/ballerinalang/openapi/CodeGenerator.java
@@ -120,18 +120,18 @@ public class CodeGenerator {
 
         List<GenSrcFile> genFiles = generateBalSource(type, definitionPath, reldefinitionPath, serviceName);
         writeGeneratedSources(genFiles, srcPath, implPath, type);
     }
 
-
     /**
      * Generates ballerina source for provided Open API Definition in {@code definitionPath}.
      * Generated source will be written to a ballerina module at {@code outPath}
      * Method can be user for generating Ballerina clients.
      *
      * @param executionPath  Command execution path
      * @param definitionPath Input Open Api Definition file path
+     * @param serviceName    service name
      * @param outPath        Destination file path to save generated source files. If not provided
      *                       {@code definitionPath} will be used as the default destination path
      * @throws IOException               when file operations fail
      * @throws BallerinaOpenApiException when code generator fails
      */
diff --git a/tests/jballerina-integration-test/src/test/java/org/ballerinalang/test/packaging/PackagingTestCase.java b/tests/jballerina-integration-test/src/test/java/org/ballerinalang/test/packaging/PackagingTestCase.java
index 25f50654eb2..79c8c6edb95 100644
--- a/tests/jballerina-integration-test/src/test/java/org/ballerinalang/test/packaging/PackagingTestCase.java
+++ b/tests/jballerina-integration-test/src/test/java/org/ballerinalang/test/packaging/PackagingTestCase.java
@@ -36,24 +36,24 @@ import org.wso2.ballerinalang.util.RepoUtils;
 
 import java.io.BufferedReader;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStreamReader;
-import java.net.HttpURLConnection;
 import java.nio.charset.Charset;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.time.LocalDateTime;
 import java.time.format.DateTimeFormatter;
 import java.util.Map;
 
+import javax.net.ssl.HttpsURLConnection;
+
 import static java.util.concurrent.TimeUnit.SECONDS;
 import static org.awaitility.Awaitility.given;
 import static org.ballerinalang.cli.module.util.Utils.convertToUrl;
-import static org.ballerinalang.cli.module.util.Utils.createHttpUrlConnection;
-import static org.ballerinalang.cli.module.util.Utils.initializeSsl;
+import static org.ballerinalang.cli.module.util.Utils.createHttpsUrlConnection;
 import static org.ballerinalang.cli.module.util.Utils.setRequestMethod;
 import static org.ballerinalang.test.packaging.ModulePushTestCase.REPO_TO_CENTRAL_SUCCESS_MSG;
 import static org.wso2.ballerinalang.compiler.util.ProjectDirConstants.BLANG_COMPILED_PKG_BINARY_EXT;
 import static org.wso2.ballerinalang.util.RepoUtils.BALLERINA_STAGE_CENTRAL;
 
@@ -180,13 +180,12 @@ public class PackagingTestCase extends BaseTest {
         Assert.assertTrue(actualMsg.contains("0.1.0"));
     }
 
     @Test(description = "Test pullCount of a package from central", dependsOnMethods = "testPull", enabled = false)
     public void testPullCount() throws IOException {
-        initializeSsl();
         String url = RepoUtils.getRemoteRepoURL() + "/modules/info/" + orgName + "/" + moduleName + "/*/";
-        HttpURLConnection conn = createHttpUrlConnection(convertToUrl(url), "", 0, "", "");
+        HttpsURLConnection conn = createHttpsUrlConnection(convertToUrl(url), "", 0, "", "");
         conn.setInstanceFollowRedirects(false);
         setRequestMethod(conn, Utils.RequestMethod.GET);
 
         int statusCode = conn.getResponseCode();
         if (statusCode == 200) {

Vulnerable code: import java.net.HttpURLConnection;
import static org.ballerinalang.cli.module.util.Utils.createHttpUrlConnection;
import static org.ballerinalang.cli.module.util.Utils.initializeSsl;
        HttpURLConnection conn = null;
            initializeSsl();
            conn = createHttpUrlConnection(convertToUrl(url + supportedVersionRange), proxyHost, proxyPort,
                    proxyUsername, proxyPassword);
            if (getStatusCode(conn) == HttpURLConnection.HTTP_MOVED_TEMP) {
                conn = createHttpUrlConnection(convertToUrl(newUrl), proxyHost, proxyPort, proxyUsername,
                        proxyPassword);
     * @param conn                  http connection
    private static void createBaloInHomeRepo(HttpURLConnection conn, String modulePathInBaloCache,
     * @param conn             http connection
    private static void writeBaloFile(HttpURLConnection conn, Path baloPath, String fullModuleName,
     * @param conn           http connection
    private static void handleErrorResponse(HttpURLConnection conn, String url, String moduleFullName) {
import java.net.HttpURLConnection;
import static org.ballerinalang.cli.module.util.Utils.createHttpUrlConnection;
import static org.ballerinalang.cli.module.util.Utils.initializeSsl;
        initializeSsl();
        HttpURLConnection conn = createHttpUrlConnection(convertToUrl(url), proxyHost, proxyPort, proxyUsername,
                proxyPassword);
     * @param conn       http connection
    private static void handleResponse(HttpURLConnection conn, String orgName, String moduleName, String version) {
            if (statusCode == HttpURLConnection.HTTP_OK) {
            } else if (statusCode == HttpURLConnection.HTTP_UNAUTHORIZED) {
            } else if (statusCode == HttpURLConnection.HTTP_BAD_REQUEST) {
import java.net.HttpURLConnection;
import static org.ballerinalang.cli.module.util.Utils.createHttpUrlConnection;
import static org.ballerinalang.cli.module.util.Utils.initializeSsl;
        initializeSsl();
        HttpURLConnection conn = createHttpUrlConnection(convertToUrl(url), proxyHost, proxyPort, proxyUsername,
                proxyPassword);
     * @param conn          http connection
    private static void handleResponse(HttpURLConnection conn, int statusCode, String terminalWidth) {
            if (statusCode == HttpURLConnection.HTTP_OK) {
import java.net.HttpURLConnection;
                httpExchange.sendResponseHeaders(HttpURLConnection.HTTP_OK,
                        response.getBytes(StandardCharsets.UTF_8).length);
import java.net.HttpURLConnection;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;

import static org.ballerinalang.cli.module.util.CliModuleConstants.SSL;
    private static TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
        public java.security.cert.X509Certificate[] getAcceptedIssuers() {
            return new java.security.cert.X509Certificate[] {};
        }

        public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType) {
            //No need to implement.
        }

        public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) {
            //No need to implement.
        }
    } };

     * Initialize SSL.
     */
    public static void initializeSsl() {
        try {
            SSLContext sc = SSLContext.getInstance(SSL);
            sc.init(null, trustAllCerts, new java.security.SecureRandom());
            HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
        } catch (NoSuchAlgorithmException | KeyManagementException e) {
            throw ErrorUtil.createCommandException("initializing SSL failed: " + e.getMessage());
        }
    }

    /**
     * Create http URL connection.
    public static HttpURLConnection createHttpUrlConnection(URL url, String proxyHost, int proxyPort,
                return (HttpURLConnection) url.openConnection();
                return (HttpURLConnection) url.openConnection(proxy);
     * @param conn   http connection
    public static void setRequestMethod(HttpURLConnection conn, RequestMethod method) {
     * @param conn http connection
    public static int getStatusCode(HttpURLConnection conn) {
import java.net.HttpURLConnection;
import static org.ballerinalang.cli.module.util.Utils.createHttpUrlConnection;
    @Test(description = "Test create http URL connection without proxy")
        HttpURLConnection conn;
        conn = createHttpUrlConnection(convertToUrl(TEST_URL), "", 0, "", "");
        conn = createHttpUrlConnection(convertToUrl(TEST_URL), "http://localhost", 9090, "testUser", "testPassword");
        HttpURLConnection conn = createHttpUrlConnection(convertToUrl(TEST_URL), "", 0, "", "");
import java.net.HttpURLConnection;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
    private static TrustManager[] trustAllCerts = new TrustManager[]{
            new X509TrustManager() {
                public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                    return new java.security.cert.X509Certificate[]{};
                }
                public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType) {
                    //No need to implement.
                }
                public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) {
                    //No need to implement.
                }
            }
    };

        try {
            SSLContext sc = SSLContext.getInstance("SSL");
            sc.init(null, trustAllCerts, new java.security.SecureRandom());
            HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
            proxy = getProxy();
        } catch (NoSuchAlgorithmException | KeyManagementException e) {
            // ignore errors
        }
                HttpURLConnection conn;
                    conn = (HttpURLConnection) remoteURI.toURL().openConnection();
                    conn = (HttpURLConnection) remoteURI.toURL().openConnection(this.proxy);

import java.net.HttpURLConnection;
import static org.ballerinalang.cli.module.util.Utils.createHttpUrlConnection;
import static org.ballerinalang.cli.module.util.Utils.initializeSsl;
        initializeSsl();
        HttpURLConnection conn = createHttpUrlConnection(convertToUrl(url), "", 0, "", "");
Fixed code: import javax.net.ssl.HttpsURLConnection;
import static org.ballerinalang.cli.module.util.Utils.createHttpsUrlConnection;
        HttpsURLConnection conn = null;
            conn = createHttpsUrlConnection(convertToUrl(url + supportedVersionRange), proxyHost, proxyPort,
                                            proxyUsername, proxyPassword);
            if (getStatusCode(conn) == HttpsURLConnection.HTTP_MOVED_TEMP) {
                conn = createHttpsUrlConnection(convertToUrl(newUrl), proxyHost, proxyPort, proxyUsername,
                                                proxyPassword);
     * @param conn                  https connection
    private static void createBaloInHomeRepo(HttpsURLConnection conn, String modulePathInBaloCache,
     * @param conn             https connection
    private static void writeBaloFile(HttpsURLConnection conn, Path baloPath, String fullModuleName,
     * @param conn           https connection
    private static void handleErrorResponse(HttpsURLConnection conn, String url, String moduleFullName) {
import javax.net.ssl.HttpsURLConnection;
import static org.ballerinalang.cli.module.util.Utils.createHttpsUrlConnection;
        HttpsURLConnection conn = createHttpsUrlConnection(convertToUrl(url), proxyHost, proxyPort, proxyUsername,
                                                           proxyPassword);
     * @param conn       https connection
    private static void handleResponse(HttpsURLConnection conn, String orgName, String moduleName, String version) {
            if (statusCode == HttpsURLConnection.HTTP_OK) {
            } else if (statusCode == HttpsURLConnection.HTTP_UNAUTHORIZED) {
            } else if (statusCode == HttpsURLConnection.HTTP_BAD_REQUEST) {
import javax.net.ssl.HttpsURLConnection;

import static org.ballerinalang.cli.module.util.Utils.createHttpsUrlConnection;
        HttpsURLConnection conn = createHttpsUrlConnection(convertToUrl(url), proxyHost, proxyPort, proxyUsername,
                                                           proxyPassword);
     * @param conn          https connection
    private static void handleResponse(HttpsURLConnection conn, int statusCode, String terminalWidth) {
            if (statusCode == HttpsURLConnection.HTTP_OK) {
import javax.net.ssl.HttpsURLConnection;
                httpExchange.sendResponseHeaders(HttpsURLConnection.HTTP_OK,
                                                 response.getBytes(StandardCharsets.UTF_8).length);
     * Create https URL connection.
    public static HttpsURLConnection createHttpsUrlConnection(URL url, String proxyHost, int proxyPort,
                return (HttpsURLConnection) url.openConnection();
                return (HttpsURLConnection) url.openConnection(proxy);
     * @param conn   https connection
    public static void setRequestMethod(HttpsURLConnection conn, RequestMethod method) {
     * @param conn https connection
    public static int getStatusCode(HttpsURLConnection conn) {
import javax.net.ssl.HttpsURLConnection;

import static org.ballerinalang.cli.module.util.Utils.createHttpsUrlConnection;
    @Test(description = "Test create https URL connection without proxy")
        HttpsURLConnection conn;
        conn = createHttpsUrlConnection(convertToUrl(TEST_URL), "", 0, "", "");
        conn = createHttpsUrlConnection(convertToUrl(TEST_URL), "http://localhost", 9090, "testUser", "testPassword");
        HttpsURLConnection conn = createHttpsUrlConnection(convertToUrl(TEST_URL), "", 0, "", "");
        proxy = getProxy();
                HttpsURLConnection conn;
                    conn = (HttpsURLConnection) remoteURI.toURL().openConnection();
                    conn = (HttpsURLConnection) remoteURI.toURL().openConnection(this.proxy);
     * @param serviceName    service name
import javax.net.ssl.HttpsURLConnection;

import static org.ballerinalang.cli.module.util.Utils.createHttpsUrlConnection;
        HttpsURLConnection conn = createHttpsUrlConnection(convertToUrl(url), "", 0, "", "");