T09 · Insecure Skill Coding Practices
- Location
scripts/sitemap_gen.py:73- Finding
HTTPS Certificate and Hostname Verification Disabled
- Content
View full analysis
Vulnerability Details
File Location:
scripts/sitemap_gen.py, lines 73–75
Vulnerability Type: Improper TLS certificate validation
Risk Level: HighVulnerable Code
python ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONEThe insecure SSL context is subsequently used for outbound requests at line 81:
python resp = urllib.request.urlopen(req, timeout=timeout, context=ctx)Technical Analysis
The crawler creates a standard SSL context but explicitly disables both certificate-chain validation and hostname verification. As a result, HTTPS connections encrypt traffic without authenticating the remote server.
Any certificate—including a self-signed certificate for an unrelated hostname—can therefore be accepted. A network-positioned attacker can impersonate the requested website and return attacker-controlled HTML. The crawler will parse that HTML and enqueue injected links whose normalized network location matches the starting domain.
This behavior affects every HTTPS page retrieved through
fetch_page; it is not limited to an explicit development or testing option.Attack Path
- A user invokes the skill to crawl an HTTPS website.
- An attacker gains a network interception position, such as through a malicious access point, compromised proxy, or poisoned network route.
- The attacker intercepts the crawler's TLS connection and presents a forged or self-signed certificate.
- The crawler accepts the certificate because certificate and hostname verification are disabled.
- The attacker serves manipulated HTML containing attacker-selected links represented as belonging to the crawled domain.
- The crawler extracts and follows those links, then includes successfully returned URLs in its page list.
- The manipulated URLs are written into or printed as the generated sitemap.
Impact Assessment
The attacker does not directly obtain local operating-system privileges or a ...[truncated 459 chars]
- Remediation
View remediation
Remediation Suggestions
Retain Python's default certificate-chain and hostname validation by removing the insecure overrides:
python ctx = ssl.create_default_context()Continue passing this verified context to
urllib.request.urlopen. Do not setcheck_hostnametoFalseorverify_modetossl.CERT_NONEin normal operation.Additional hardening measures should include:
- Reject TLS certificate errors rather than silently converting every exception into an empty result.
- Log concise certificate-validation failures in verbose mode without exposing sensitive URL query data.
- Add automated tests proving that trusted certificates succeed while self-signed, expired, and hostname-mismatched certificates fail.
- If unverified TLS is needed for isolated development environments, place it behind an explicit opt-in flag with a prominent warning; never make it the default.
- Consider enforcing redirect validation so every redirect destination remains within the intended scheme and domain policy.