splunk / splunk/splunk-sdk-python
Unverified SSL context
Open
Beginner friendly
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 743
- Forks
- 387
- Avg merge
- 42m
- Merged PRs (30d)
- 4
Description
Unverified SSL context detected. This will permit insecure connections without verifyingSSL certificates. Can this use 'ssl.create_default_context()' instead.
Suggested Change:
if not verify:
# verify=False is an explicit, user-requested opt-out of certificate
# validation (e.g. for self-signed Splunk instances). Build the context
# from the public API rather than the private _create_unverified_context() helper.
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in splunklib/binding.py around line 1765, where the SSL context is created for the verify setting. Review the existing verify=False path and confirm that it uses ssl.create_default_context() while preserving the explicit opt-out for self-signed instances. The work is done when insecure-context detection is addressed without changing the requested verification behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 82/100