T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/get_chapter_pdf.py:67
- Finding
- TLS Certificate Verification Disabled for Google Drive Downloads## Vulnerability Details **File Location**: `scripts/get_chapter_pdf.py:67-71` **Vulnerability Type**: Improper TLS certificate validation **Risk Level**: Medium ### Vulnerable Code ```python download_url = f"https://drive.google.com/uc?export=download&id={file_id}" result = subprocess.run([ "wget", "--quiet", "--no-check-certificate", "-O", output_path, download_url ], capture_output=True, timeout=120) ``` ### Technical Analysis The large-file fallback invokes `wget` with `--no-check-certificate`. This option disables verification of the remote server's TLS certificate, preventing the client from confirming that it is communicating with the legitimate Google Drive service. An attacker capable of intercepting or modifying the network connection could impersonate Google Drive and return an attacker-controlled file. The script performs a basic `%PDF` header and minimum-size check, but these checks establish only that the response resembles a PDF; they do not establish its authenticity or integrity. The downloaded file is subsequently processed using `pdfplumber`. Consequently, an attacker could manipulate tariff results or expose the local PDF-processing stack to a maliciously crafted document. ### Attack Path 1. The normal `curl` download fails or returns a Google Drive confirmation page. 2. `download_from_gdrive()` invokes `download_large_file()`. 3. The fallback starts `wget` with certificate validation disabled. 4. An attacker with a network interception position impersonates `drive.google.com`. 5. The attacker returns a file beginning with `%PDF` and larger than 10,000 bytes. 6. The file passes the script's superficial validation and is saved at `output_path`. 7. The application later parses the attacker-controlled PDF and may present manipulated HS-code information. Any exploitable defect in the installed PDF-processing stack would also become reachable. ### Impact Assessment The direct impact includes loss of downloaded-d ...[truncated 522 chars]
- Remediation
- ## Remediation Suggestions - Remove `--no-check-certificate` and require normal certificate-chain and hostname validation. - Fail closed when TLS validation fails rather than silently weakening transport security. - Prefer a maintained HTTPS library that uses the operating system or `certifi` trust store and enforces explicit connection and read timeouts. - If the publisher provides checksums or signatures, verify the downloaded PDF before processing it. - Retain the `%PDF` and size checks as format sanity checks, but do not treat them as authenticity controls. - Download to a temporary file in the destination directory and atomically rename it only after all validation succeeds. - Keep `pdfplumber` and its underlying PDF-processing dependencies patched and process untrusted PDFs in a sandbox where practical.