T09 · Insecure Skill Coding Practices
Error
- Location
scripts/harvester_extended.py:35- Finding
TLS Certificate and Hostname Verification Disabled for External Data Sources
- Content
View full analysis
Optional[bytes]: """Safely fetch URL with SSL handling.""" try: ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE hdrs = {"User-Agent": "BlackSnow/0.1 (Risk Intelligence)"} if headers: hdrs.update(headers) req = urllib.request.Request(url, headers=hdrs) with urllib.request.urlopen(req, timeout=timeout, context=ctx) as response: return response.read() ``` ```python # scripts/harvester_extended.py:181-192 try: req = urllib.request.Request( self.BASE_URL, data=json.dumps(payload).encode(), headers={"Content-Type": "application/json", "User-Agent": "BlackSnow/0.1"} ) ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE with urllib.request.urlopen(req, timeout=15, context=ctx) as response: ``` ### Technical Analysis The code creates a standard TLS context and then explicitly disables both certificate verification and hostname validation. As a result, the client cannot authenticate the remote government data services it contacts. Any certificate, including a self-signed certificate controlled by an attacker, will be accepted. A network-positioned attacker can ther ...[truncated 1804 chars]- Remediation
View remediation