MLE-27557: Fix weak crypto - replace insecure TLSv1 with TLSv1.3 in ContentReader.java

[vshaniga]

This PR addresses a weak cryptography security issue (MLE-27557) by replacing the insecure TLSv1 protocol with TLSv1.3 in ContentReader.java. TLSv1 is considered cryptographically weak and vulnerable to various attacks. Upgrading to TLSv1.3 ensures stronger encryption and improved security posture.

Ran the 06mlcp test suite — no regression failures were found in testing.

[Copilot]

Pull request overview

Updates the Hadoop Connector example ContentReader to use TLS 1.3 instead of TLS 1.0 for SSL connections, addressing the weak-cryptography concern referenced in MLE-27557.

Changes:

• Switch enabled SSL protocol from TLSv1 to TLSv1.3.
• Switch SSLContext initialization from TLSv1 to TLSv1.3.
• Remove the hardcoded (TLS 1.0-era) cipher suite allowlist from the example.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[vshaniga]

Code Change Summary

1. getEnabledProtocols() — Protocol Upgrade Replaced TLSv1 with TLSv1.3.

2. SSLContext.getInstance(...) — Context Algorithm Upgrade Updated from SSLContext.getInstance("TLSv1") to SSLContext.getInstance("TLSv1.3") to keep the SSL context consistent with the enabled protocol.

3. getEnabledCipherSuites() — Cipher Suite Cleanup Removed hardcoded CBC-based cipher suites (TLS_DHE_RSA_WITH_AES_256_CBC_SHA, etc.) which are not supported in TLSv1.3. Returning null delegates cipher selection to the JVM defaults, which will use secure TLSv1.3 AEAD ciphers (e.g., TLS_AES_256_GCM_SHA384).

[NeoSaber]

The changes look good to me. The issue copilot found seems important to address, but it also looks out of scope for this PR. I suggest making a ticket for that one so it can be handled by someone later.

[DarrenJAN]

This changes looks good to me

[abika5]

The mapreduce module is not used in the MLCP workflows, so I am fine with this change to appease the Polaris scan.

[vshaniga]

@NeoSaber I’ve created a ticket to track the Copilot-identified issue: MLE-28226