T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/download_arxiv.py:43- Finding
TLS Certificate Validation Bypass for arXiv Requests
- Content
View full analysis
str: req = urllib.request.Request(url, headers={"User-Agent": "arxiv-related-papers-skill/1.0"}) for attempt in range(4): try: with urllib.request.urlopen(req, timeout=timeout, context=_SSL_CONTEXT) as resp: return resp.read().decode("utf-8", errors="replace") except urllib.error.HTTPError as err: if err.code not in (429, 503) or attempt == 3: raise sleep_s = 1.5 * (2**attempt) print(f"WARN: arXiv rate limited ({err.code}), retrying in {sleep_s:.1f}s.", file=sys.stderr) time.sleep(sleep_s) except urllib.error.URLError as err: # Some local Python environments miss CA certificates; retry once without verification. if "CERTIFICATE_VERIFY_FAILED" in str(err): print("WARN: SSL verify failed, retrying without certificate verification.", file=sys.stderr) with urllib.request.urlopen( req, timeout=timeout, context=_SSL_CONTEXT_UNVERIFIED ) as resp: return resp.read().decode("utf-8", errors="replace") raise raise RuntimeError("Unexpected fetch loop termination") ``` ```python def download_file(url: str, destination: Path, timeout: int = 60) -> None: req = urllib.request.Request(url, headers={"User-Agent": "arxiv-related-papers-skill/1.0"}) try: with urllib.request.urlopen(req, timeout=timeout, context=_SSL_CONTEXT) as resp: data = resp.read() except urllib.error.URLError as err: if "CERTIFICATE_V ...[truncated 3033 chars]- Remediation
View remediation
str: req = urllib.request.Request( url, headers={"User-Agent": "arxiv-related-papers-skill/1.0"}, ) with urllib.request.urlopen( req, timeout=timeout, context=ssl.create_default_context(), ) as resp: return resp.read().decode("utf-8", errors="replace") ``` Certificate errors should be reported to the caller rather than retried with verification disabled. ]]>