fix(conf): reject tls_roots with unsafe verification

Reject tls_roots combined with tls_verify=unsafe_off across Sender and QWP config facades. Enforce the invariant in fluent and low-level TLS construction paths, with regression coverage for PEM and password-protected trust stores.

Author: jerrinot

core/src/main/java/io/questdb/client/ClientTlsConfiguration.java

@@ -33,6 +33,9 @@ public class ClientTlsConfiguration {
     private final String trustStorePath;
 
     public ClientTlsConfiguration(String trustStorePath, char[] trustStorePassword, int tlsValidationMode) {
+        if (trustStorePath != null && tlsValidationMode == TLS_VALIDATION_MODE_NONE) {
+            throw new IllegalArgumentException("custom trust store cannot be combined with disabled TLS validation");
+        }
         this.trustStorePath = trustStorePath;
         this.trustStorePassword = trustStorePassword;
         this.tlsValidationMode = tlsValidationMode;

core/src/main/java/io/questdb/client/Sender.java

@@ -934,6 +934,7 @@ enum Transport {
      */
     final class LineSenderBuilder {
         private static final int AUTO_FLUSH_DISABLED = 0;
+        private static final String TLS_ROOTS_INSECURE_CONFIG_ERROR = "tls_roots cannot be combined with tls_verify=unsafe_off; remove tls_verify to use custom roots, or remove tls_roots to disable certificate validation";
         // close() drain timeout. Default applied at build() time. 0 or -1
         // means "fast close" (skip the drain entirely); any positive value
         // bounds the wait for ackedFsn to catch up to publishedFsn. Uses
@@ -3576,6 +3577,9 @@ private LineSenderBuilder fromConfig(CharSequence configurationString) {
             if (trustStorePath == null && trustStorePassword != null) {
                 throw new LineSenderException("tls_roots_password was configured, but tls_roots is missing");
             }
+            if (trustStorePath != null && tlsValidationMode == TlsValidationMode.INSECURE) {
+                throw new LineSenderException(TLS_ROOTS_INSECURE_CONFIG_ERROR);
+            }
             if (protocol == PROTOCOL_HTTP || protocol == PROTOCOL_WEBSOCKET) {
                 if (user != null) {
                     httpUsernamePassword(user, password);
@@ -3835,6 +3839,9 @@ static void validateWsConfig(ConfigView view, boolean tls) {
             if (tlsRoots == null && tlsRootsPassword != null) {
                 throw new IllegalArgumentException("tls_roots_password requires tls_roots");
             }
+            if (tlsRoots != null && "unsafe_off".equals(tlsVerify)) {
+                throw new IllegalArgumentException(TLS_ROOTS_INSECURE_CONFIG_ERROR);
+            }
         }
 
         /**
@@ -3971,6 +3978,9 @@ private void validateParameters() {
             if (!tlsEnabled && tlsValidationMode != TlsValidationMode.DEFAULT) {
                 throw new LineSenderException("TLS validation disabled, but TLS was not enabled");
             }
+            if (trustStorePath != null && tlsValidationMode == TlsValidationMode.INSECURE) {
+                throw new LineSenderException("custom trust store cannot be combined with disabled TLS validation");
+            }
             if (keyId != null && bufferCapacity < MIN_BUFFER_SIZE) {
                 throw new LineSenderException("Requested buffer too small ")
                         .put("[minimalCapacity=").put(MIN_BUFFER_SIZE)
@@ -4172,6 +4182,9 @@ private LineSenderBuilder setCustomTrustStore(String trustStorePath, char[] trus
                 if (Chars.isBlank(trustStorePath)) {
                     throw new LineSenderException("trust store path cannot be empty nor null");
                 }
+                if (tlsValidationMode == TlsValidationMode.INSECURE) {
+                    throw new LineSenderException("custom trust store cannot be configured when TLS validation is disabled");
+                }
 
                 LineSenderBuilder.this.trustStorePath = trustStorePath;
                 LineSenderBuilder.this.trustStorePassword = trustStorePassword;
@@ -4190,6 +4203,9 @@ private LineSenderBuilder setCustomTrustStore(String trustStorePath, char[] trus
              * @return an instance of LineSenderBuilder for further configuration
              */
             public LineSenderBuilder disableCertificateValidation() {
+                if (LineSenderBuilder.this.trustStorePath != null) {
+                    throw new LineSenderException("TLS validation cannot be disabled when a custom trust store is configured");
+                }
                 LineSenderBuilder.this.tlsValidationMode = TlsValidationMode.INSECURE;
                 return LineSenderBuilder.this;
             }

core/src/main/java/io/questdb/client/cutlass/qwp/client/QwpQueryClient.java

@@ -140,6 +140,7 @@ public class QwpQueryClient implements QuietCloseable {
     private static final long DEFAULT_FAILOVER_MAX_BACKOFF_MS = 1_000L;
     private static final long DEFAULT_FAILOVER_MAX_DURATION_MS = 30_000L;
     private static final int DEFAULT_IO_BUFFER_POOL_SIZE = 4;
+    private static final String TLS_ROOTS_INSECURE_CONFIG_ERROR = "tls_roots cannot be combined with tls_verify=unsafe_off; remove tls_verify to use custom roots, or remove tls_roots to disable certificate validation";
     /**
      * How long {@link #connect()} waits to read the {@code SERVER_INFO} frame
      * from each endpoint before giving up and moving to the next. 5 seconds is
@@ -550,6 +551,9 @@ public static void validateConfig(ConfigView view, boolean tls) {
         if (tlsRoots == null && tlsRootsPassword != null) {
             throw new IllegalArgumentException("tls_roots_password requires tls_roots");
         }
+        if (tlsRoots != null && "unsafe_off".equals(tlsVerify)) {
+            throw new IllegalArgumentException(TLS_ROOTS_INSECURE_CONFIG_ERROR);
+        }
         // Mirror fromConfig's effective values: a missing bound takes its
         // default, so the ordering is enforced even when only one key is set
         // (e.g. failover_backoff_max_ms alone, below the default initial backoff).

core/src/main/java/io/questdb/client/network/TlsTrustStore.java

@@ -79,8 +79,9 @@ public static SSLEngine createSslEngine(
             String peerHost,
             Class<?> resourceAnchor
     ) throws CertificateException, IOException, KeyManagementException, KeyStoreException, NoSuchAlgorithmException {
-        // custom roots with validation disabled would silently skip hostname verification below
-        assert trustStorePath == null || !insecure;
+        if (trustStorePath != null && insecure) {
+            throw new IllegalArgumentException("custom trust store cannot be combined with disabled TLS validation");
+        }
         SSLContext sslContext;
         if (trustStorePath != null) {
             sslContext = SSLContext.getInstance("TLS");

core/src/test/java/io/questdb/client/test/QuestDBBuilderTest.java

@@ -114,6 +114,14 @@ public void testMalformedIngressConfigRejectedAtBuildWithMinZero() {
                 "ws::addr=127.0.0.1:1;sf_durability=flush;sender_pool_min=0;query_pool_min=0;", "not yet supported");
     }
 
+    @Test
+    public void testTlsRootsWithUnsafeOffRejectedAtBuildWithMinZero() {
+        assertBuildRejected(
+                "wss::addr=127.0.0.1:1;tls_roots=/ca.pem;tls_verify=unsafe_off;sender_pool_min=0;query_pool_min=0;",
+                "tls_roots cannot be combined with tls_verify=unsafe_off"
+        );
+    }
+
     @Test
     public void testMalformedPoolValueRejectedAtBuild() {
         // A non-numeric pool value is rejected at build()'s pool-key resolution,

core/src/test/java/io/questdb/client/test/cutlass/line/LineSenderBuilderTest.java

@@ -44,6 +44,7 @@
 public class LineSenderBuilderTest {
     private static final String AUTH_TOKEN_KEY1 = "UvuVb1USHGRRT08gEnwN2zGZrvM4MsLQ5brgF6SVkAw=";
     private static final String LOCALHOST = "localhost";
+    private static final String TLS_ROOTS_INSECURE_ERROR = "tls_roots cannot be combined with tls_verify=unsafe_off; remove tls_verify to use custom roots, or remove tls_roots to disable certificate validation";
     private static final char[] TRUSTSTORE_PASSWORD = "questdb".toCharArray();
     private static final String TRUSTSTORE_PATH = "/keystore/server.keystore";
 
@@ -187,6 +188,9 @@ public void testConfStringValidation() throws Exception {
             assertConfStrError("http::addr=localhost;tls_roots=/some/path;", "custom trust store configured, but TLS was not enabled");
             assertConfStrOk("https::addr=localhost;tls_roots=/some/path;protocol_version=2;");
             assertConfStrError("http::addr=localhost;tls_roots_password=hunter123;", "tls_roots_password was configured, but tls_roots is missing");
+            assertConfStrError("tcps::addr=localhost;tls_roots=/ca.pem;tls_verify=unsafe_off;", TLS_ROOTS_INSECURE_ERROR);
+            assertConfStrError("https::addr=localhost;tls_verify=unsafe_off;tls_roots=/ca.pem;protocol_version=2;", TLS_ROOTS_INSECURE_ERROR);
+            assertConfStrError("tcps::addr=localhost;tls_roots=/ca.p12;tls_roots_password=secret;tls_verify=unsafe_off;", TLS_ROOTS_INSECURE_ERROR);
             assertConfStrError("tcp::addr=localhost;user=foo;", "token cannot be empty nor null");
             assertConfStrError("tcp::addr=localhost;username=foo;", "token cannot be empty nor null");
             assertConfStrError("tcp::addr=localhost;token=foo;", "TCP token is configured, but user is missing");
@@ -307,6 +311,25 @@ public void testCustomTruststorePasswordCannotBeNull() {
                 () -> Sender.builder(Sender.Transport.TCP).advancedTls().customTrustStore(TRUSTSTORE_PATH, null));
     }
 
+    @Test
+    public void testCustomTruststoreAndDisabledValidationCannotBeCombinedViaRetainedSettings() {
+        Sender.LineSenderBuilder customRootsBuilder = Sender.builder(Sender.Transport.TCP).enableTls();
+        Sender.LineSenderBuilder.AdvancedTlsSettings customRootsSettings = customRootsBuilder.advancedTls();
+        customRootsSettings.customTrustStore(TRUSTSTORE_PATH, TRUSTSTORE_PASSWORD);
+        assertThrows(
+                "TLS validation cannot be disabled when a custom trust store is configured",
+                customRootsSettings::disableCertificateValidation
+        );
+
+        Sender.LineSenderBuilder insecureBuilder = Sender.builder(Sender.Transport.TCP).enableTls();
+        Sender.LineSenderBuilder.AdvancedTlsSettings insecureSettings = insecureBuilder.advancedTls();
+        insecureSettings.disableCertificateValidation();
+        assertThrows(
+                "custom trust store cannot be configured when TLS validation is disabled",
+                () -> insecureSettings.customTrustStore(TRUSTSTORE_PATH, TRUSTSTORE_PASSWORD)
+        );
+    }
+
     @Test
     public void testCustomPemRootsDoNotRequirePassword() throws Exception {
         assertMemoryLeak(() -> {

core/src/test/java/io/questdb/client/test/cutlass/qwp/client/LineSenderBuilderWebSocketTest.java

@@ -1037,6 +1037,18 @@ public void testWssConfigString_tlsRootsPasswordWithoutRoots_fails() {
         );
     }
 
+    @Test
+    public void testWssConfigString_tlsRootsWithUnsafeOff_fails() {
+        assertBadConfig(
+                "wss::addr=localhost:9000;tls_roots=/ca.pem;tls_verify=unsafe_off;",
+                "tls_roots cannot be combined with tls_verify=unsafe_off"
+        );
+        assertBadConfig(
+                "wss::addr=localhost:9000;tls_verify=unsafe_off;tls_roots=/ca.p12;tls_roots_password=secret;",
+                "tls_roots cannot be combined with tls_verify=unsafe_off"
+        );
+    }
+
     @Test
     public void testWsConfigString_withToken() throws Exception {
         assertMemoryLeak(() -> {

core/src/test/java/io/questdb/client/test/cutlass/qwp/client/QwpQueryClientFromConfigTest.java

@@ -40,6 +40,8 @@
  */
 public class QwpQueryClientFromConfigTest {
 
+    private static final String TLS_ROOTS_INSECURE_ERROR = "tls_roots cannot be combined with tls_verify=unsafe_off; remove tls_verify to use custom roots, or remove tls_roots to disable certificate validation";
+
     @Test
     public void testAddrAcceptsHostWithoutPort() {
         // Host-only accepted; port defaults to the public DEFAULT_WS_PORT constant.
@@ -983,6 +985,18 @@ public void testTlsRootsWithPasswordAccepted() {
         assertParses("wss::addr=db:9000;tls_roots=/etc/qdb/ca.p12;tls_roots_password=secret;");
     }
 
+    @Test
+    public void testTlsRootsWithUnsafeOffRejected() {
+        assertReject(
+                "wss::addr=db:9000;tls_roots=/etc/qdb/ca.pem;tls_verify=unsafe_off;",
+                TLS_ROOTS_INSECURE_ERROR
+        );
+        assertReject(
+                "wss::addr=db:9000;tls_verify=unsafe_off;tls_roots=/etc/qdb/ca.p12;tls_roots_password=secret;",
+                TLS_ROOTS_INSECURE_ERROR
+        );
+    }
+
     @Test
     public void testPemTlsRootsWithoutPasswordAccepted() {
         assertParses("wss::addr=db:9000;tls_roots=/etc/qdb/ca.pem;");

core/src/test/java/io/questdb/client/test/network/TlsTrustStoreTest.java

@@ -24,6 +24,7 @@
 
 package io.questdb.client.test.network;
 
+import io.questdb.client.ClientTlsConfiguration;
 import io.questdb.client.network.TlsTrustStore;
 import org.junit.Assert;
 import org.junit.Test;
@@ -43,6 +44,37 @@
 public class TlsTrustStoreTest {
 
     private static final String RESOURCE_PREFIX = "/io/questdb/client/test/network/";
+    private static final String TLS_ROOTS_INSECURE_ERROR = "custom trust store cannot be combined with disabled TLS validation";
+
+    @Test
+    public void testClientTlsConfigurationRejectsCustomRootsWithDisabledValidation() {
+        try {
+            new ClientTlsConfiguration(
+                    "/ca.pem",
+                    null,
+                    ClientTlsConfiguration.TLS_VALIDATION_MODE_NONE
+            );
+            Assert.fail("expected custom roots with disabled validation to be rejected");
+        } catch (IllegalArgumentException e) {
+            Assert.assertEquals(TLS_ROOTS_INSECURE_ERROR, e.getMessage());
+        }
+    }
+
+    @Test
+    public void testCreateSslEngineRejectsCustomRootsWithDisabledValidation() throws Exception {
+        try {
+            TlsTrustStore.createSslEngine(
+                    "/ca.pem",
+                    null,
+                    true,
+                    "localhost",
+                    TlsTrustStoreTest.class
+            );
+            Assert.fail("expected custom roots with disabled validation to be rejected");
+        } catch (IllegalArgumentException e) {
+            Assert.assertEquals(TLS_ROOTS_INSECURE_ERROR, e.getMessage());
+        }
+    }
 
     @Test
     public void testJksTrustStoreStillSupported() throws Exception {