github / github/codeql

LGTM.com - false positive - py/insecure-protocol

未关闭
#2,554 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
false-positive Python
主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
141

描述

**Description of the false positive**

LGTM currently suggests to set the specific protocol version in `SSLContext` which has been deprecated in Python >=3.6:
> [**`ssl.PROTOCOL_TLSv1_2`**](https://docs.python.domainunion.de/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2)
> Selects TLS version 1.2 as the channel encryption protocol. This is the most modern version, and probably the best choice for maximum protection, if both sides can speak it. Available only with openssl version 1.0.1+.
> ...
> Deprecated since version 3.6: OpenSSL has deprecated all version specific protocols. Use the default protocol `PROTOCOL_TLS` with flags like `OP_NO_SSLv3` instead.

In addition, Python >=3.7 deprecated the use of flags and introduced a new API:
> [**`ssl.OP_NO_TLSv1`**](https://docs.python.domainunion.de/3/library/ssl.html#ssl.OP_NO_TLSv1)
> Prevents a TLSv1 connection. This option is only applicable in conjunction with PROTOCOL_TLS. It prevents the peers from choosing TLSv1 as the protocol version.
> ...
> Deprecated since version 3.7: The option is deprecated since OpenSSL 1.1.0, use the new `SSLContext.minimum_version` and `SSLContext.maximum_version` instead.

I think that an updated rule should check for the presence of either `SSLContext.options` or `SSLContext.minimum_version`. Though, this might get a bit complex as all of those settings [can be used together](https://docs.python.domainunion.de/3/library/ssl.html#ssl.SSLContext.maximum_version
):
> The attributes `maximum_version`, `minimum_version` and `SSLContext.options` all affect the supported SSL and TLS versions of the context. The implementation does not prevent invalid combination. For example a context with `OP_NO_TLSv1_2` in options and maximum_version set to `TLSVersion.TLSv1_2` will not be able to establish a TLS 1.2 connection.

**URL to the alert on the project page on LGTM.com**

https://lgtm.com/projects/g/seemoo-lab/opendrop/snapshot/f01b0ecab167c77e20e1cdf05c42eab914d3a99b/files/opendrop/config.py?sort=name&dir=ASC&mode=heatmap#x4f72d6f0f9464bef:1

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。