pycharm-security: `verify=False` not found as a potential security problem (RQ101)
Hi @tonybaloney
just installed PyCharm Security 1.04 for IntelliJ IDEA Ultimate.
Following snippet does not show a warning
try:
response = requests.post(
URL, auth=self.auth, headers=self.headers, json=ordered_data, verify=False, timeout=(3.05, 27)
)
except (ConnectionError, HTTPError, Timeout, TooManyRedirects, URLRequired) as exception:
messages.append('There was an error connecting via DATEVconnect. Please contact a developer.')
state = 'ERROR'
LOG.exception(exception)
As I understand RQ101 should cover this.
As side notes:
- bandit returns this
>> Issue: [B501:request_with_no_cert_validation] Requests call with verify=False disabling SSL certificate checks, security issue.
Severity: High Confidence: High
Location: src/Products/Datev/DATEVconnect/client.py:106
More Info: https://bandit.readthedocs.io/en/latest/plugins/b501_request_with_no_cert_validation.html
- your plugin works otherwise, as
TMP100is correctly raised for the following line
zipname = mktemp('.zip')
About this issue
- Original URL
- State: closed
- Created 4 years ago
- Comments: 16 (16 by maintainers)
that issue is fixed in 1.0.13. I also did a check for any other unsafe casts and that’s it https://github.com/tonybaloney/pycharm-security/releases/tag/1.0.13
I haven’t tested in IDEA yet. Let me do that