T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/sec_finance.py:67
- Finding
- Automatic TLS Certificate Validation Bypass for SEC Requests## Vulnerability Details **File Location**: `scripts/sec_finance.py:67-71, 85-89, 110-116` **Vulnerability Type**: Automatic fallback to an SSL context that disables certificate and hostname validation **Risk Level**: High ### Vulnerable Code ```python def _fallback_insecure_ctx() -> ssl.SSLContext: ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE return ctx ``` The insecure context is automatically attempted by the JSON request helper: ```python for ctx_factory in (_secure_ctx, _fallback_insecure_ctx): try: with urllib.request.urlopen(req, timeout=timeout, context=ctx_factory()) as resp: return json.loads(resp.read()) except ssl.SSLError as e: last_error = e continue except urllib.error.HTTPError as e: if e.code == 429 and attempt < retries: time.sleep(3 * (attempt + 1)) last_error = e break if e.code == 404: raise ValueError(f"CIK or resource not found: {url}") from e raise ValueError(f"HTTP {e.code} fetching {url}: {e.reason}") from e except urllib.error.URLError as e: last_error = e continue ``` It is also automatically attempted by the text request helper: ```python last_error = None for ctx_factory in (_secure_ctx, _fallback_insecure_ctx): try: with urllib.request.urlopen(req, timeout=timeout, context=ctx_factory()) as resp: return resp.read().decode("utf-8", errors="replace") except Exception as e: last_error = e raise ConnectionError(f"Failed to fetch {url}: {last_error}") ``` ### Technical Analysis `_fallback_insecure_ctx()` disables both certificate-chain validation and hostname verification. Consequently, HTTPS no longer authenticates the remote SEC server when this context is used. Both network helpers automatically ...[truncated 1839 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `_fallback_insecure_ctx()` and never set `verify_mode` to `ssl.CERT_NONE` or `check_hostname` to `False`. 2. Use only `ssl.create_default_context()` for SEC requests and fail closed when certificate validation fails. 3. If a deployment requires a private or additional certificate authority, configure an explicit trusted CA bundle through `cafile` or the system trust store rather than disabling verification. 4. Narrow exception handling in `_get_text`; do not use `except Exception` to trigger changes in transport security. 5. Retry only errors that are demonstrably transient, while preserving the same validated SSL context for every retry. 6. Log or return a clear certificate-validation error so operators can repair the host trust store instead of silently weakening security. 7. Add tests asserting that invalid, expired, self-signed, and hostname-mismatched certificates are rejected without an insecure retry.