CWE-295: Go SDK HTTP client hardcodes InsecureSkipVerify:true by default
Open
- Dominant language
- Java
- Stars
- 15.9k
- Forks
- 3.9k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 520
Description
### Summary
The Apache Doris Go SDK HTTP client hardcodes `InsecureSkipVerify: true` in its default transport. All SDK API calls — including those with authentication — transmit credentials over unverified TLS.
### Impact
Doris database credentials exposed to MITM on any Go SDK client connection.
### Remediation
Enable TLS verification by default. Full report available.
Contributor guide
Research direction
Locate the Apache Doris Go SDK HTTP client and inspect how its default transport configures TLS. Enable certificate verification by default, then verify that authenticated SDK API calls no longer use an unverified connection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100