Merge pull request #966 from AzureAD/avdunn/codeql-suppressions

Suppress CodeQL issues

Author: Avery-Dunn

msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/ClientCertificate.java

@@ -110,7 +110,7 @@ static ClientCertificate create(final PrivateKey key, final X509Certificate publ
     }
 
     private static byte[] getHashSha1(final byte[] inputBytes) throws NoSuchAlgorithmException {
-        final MessageDigest md = MessageDigest.getInstance("SHA-1");
+        final MessageDigest md = MessageDigest.getInstance("SHA-1"); // CodeQL [SM05136] ADFS scenarios require SHA-1 hashing, and we cannot remove our use until ADFS does.
         md.update(inputBytes);
         return md.digest();
     }

msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/DefaultHttpClientManagedIdentity.java

@@ -87,7 +87,7 @@ public static void addTrustedCertificateThumbprint(HttpsURLConnection httpsUrlCo
 
         // CodeQL [SM03767] False positive: the TrustManager created later on will only trust a certificate with a specific thumbprint.
         if (httpsUrlConnection.getHostnameVerifier() != ALL_HOSTS_ACCEPT_HOSTNAME_VERIFIER) {
-            httpsUrlConnection.setHostnameVerifier(ALL_HOSTS_ACCEPT_HOSTNAME_VERIFIER);
+            httpsUrlConnection.setHostnameVerifier(ALL_HOSTS_ACCEPT_HOSTNAME_VERIFIER); // CodeQL [SM03767] We expect the connection to work against a specific server side certificate only, so it's safe to disable the host name verification.
         }
 
         // Create a Trust manager that trusts only certificate with specified thumbprint.