2.32.5 breaks passing custom SSL context
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 54.3k
- Forks
- 10.4k
- Avg merge
- 16h 43m
- Merged PRs (30d)
- 3
Description
2.32.5 change https://github.com/psf/requests/commit/90fee0876aea97c639b3bf698d83a12876d2f160 breaks passing of custom ssl context using an adapter like this:
class SSLContextAdapter(requests.adapters.HTTPAdapter):
@override
def init_poolmanager(self, *args: Any, **kwargs: Any) -> Any:
kwargs["ssl_context"] = ssl.create_default_context()
return super().init_poolmanager(*args, **kwargs) # type: ignore
ssl_adapter = SSLContextAdapter()
session.mount("https://", ssl_adapter)
Now, if verify=True, the code in https://github.com/psf/requests/blob/90fee0876aea97c639b3bf698d83a12876d2f160/src/requests/adapters.py#L292-L313 always sets ca_certs, which causes urllib3 to modify the ssl_context by loading more certs into it here.
EDIT: I can be fixed by overriding also cert_verify:
class SSLContextAdapter(requests.adapters.HTTPAdapter):
@override
def init_poolmanager(self, *args: Any, **kwargs: Any) -> Any:
kwargs["ssl_context"] = ssl.create_default_context()
return super().init_poolmanager(*args, **kwargs) # type: ignore
@override
def cert_verify(self, *_args: Any, **_kwargs: Any) -> None:
pass
ssl_adapter = SSLContextAdapter()
session.mount("https://", ssl_adapter)
I'd say this belongs to documentation and needs some tests, so that future changes don't break it again - will prepare a PR if I'll have time.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with src/requests/adapters.py at lines 292-313 and reproduce the custom SSLContextAdapter example with verify=True. Compare the behavior with urllib3's ssl_.py at lines 456-460; done means the regression is covered by tests and the custom SSL context behavior is documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100