T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:18- Finding
TLS certificate verification is disabled while the command reports successful validation
- Content
View full analysis
Optional[bytes]: """Get SSL certificate from host.""" try: context = ssl.create_default_context() context.check_hostname = False context.verify_mode = ssl.CERT_NONE with socket.create_connection((hostname, port), timeout=timeout) as sock: with context.wrap_socket(sock, server_hostname=hostname) as ssock: cert_der = ssock.getpeercert(binary_form=True) return cert_der except Exception as e: return None ``` The unauthenticated certificate retrieval is subsequently presented as validation: ```python def validate_command(args): """Handle validate command (basic chain validation).""" # Note: This is a simplified validation result = check_certificate(args.domain, args.port) if result['status'] not in ['valid', 'expiring_soon']: print(f"❌ Cannot validate: {result['error']}") return print(f"🔒 Basic validation for {result['domain']}:{result['port']}") print(f"✓ Certificate retrieved successfully") print(f"✓ Certificate is {'expired' if result['status'] == 'expired' else 'currently valid'}") print(f"✓ Issuer: {result['issuer']}") if result['days_remaining'] is not None: if result['days_remaining'] > 30: print(f"✓ Expiration: {result['days_remaining']} days remaining (good)") elif result['days_remaining'] > 0: print(f"⚠ Expiration: {result['days_remaining']} days remaining (renew soon)") else: print(f"✗ Expiration: Certificate expired {abs(result['days_remaining'])} days ago") if not CRYPTOGRAPHY_AVAILABLE: print("⚠ Advanced val ...[truncated 2761 chars]- Remediation
View remediation