T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check_ssl.py:187- Finding
JSON Output Mode Bypasses Certificate Failure Exit Codes
- Content
View full analysis
- Remediation
View remediation
int: has_failure = any(r["status"] != "ok" for r in results) has_warning = any( r["status"] == "ok" and r["days_remaining"] is not None and 0 < r["days_remaining"] <= warn_days for r in results ) if has_failure: return 2 if has_warning: return 1 return 0 if args.json: print(json.dumps(results, indent=2)) else: print_report(results, args.warn_days) sys.exit(determine_exit_code(results, args.warn_days)) ``` Refactor `print_report()` so it no longer calls `sys.exit()` internally, preventing output format from controlling security-relevant process behavior. Add automated tests that verify exit codes in both output modes for: - Valid certificates above the warning threshold: exit 0 - Certificates within the warning threshold: exit 1 - Expired or expiring-today certificates: exit 2 - Certificate verification failures: exit 2 - DNS, timeout, connection, and TLS failures: exit 2 ]]>