hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Rust: Clean up the .qhelp a little.

Browse Source
This commit is contained in:
Geoffrey White
2025-11-12 18:10:02 +00:00
parent bb78fdf150
commit 87d66c69a3
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
rust/ql/src/queries/security/CWE-295/DisabledCertificateCheck.qhelp
View File

@@ -5,13 +5,13 @@
<overview>
<p>
In Rust, the <code>danger_accept_invalid_certs</code> and <code>danger_accept_invalid_hostnames</code> options on TLS connectors and HTTP clients control whether certificate and hostname verification are performed. If set to <code>true</code>, the client will accept any certificate and any host name, making it susceptible to man-in-the-middle attacks.
The <code>danger_accept_invalid_certs</code> and <code>danger_accept_invalid_hostnames</code> options on TLS connectors and HTTP clients control whether certificate and hostname verification are performed. If set to <code>true</code>, the client will accept any certificate or any host name, making it susceptible to man-in-the-middle attacks.
</p>
</overview>
<recommendation>
<p>
Do not set <code>danger_accept_invalid_certs</code> or <code>danger_accept_invalid_hostnames</code> to <code>true</code> except in tests or controlled environments. In production, always ensure certificate and hostname verification are enabled to prevent security risks.
Do not set <code>danger_accept_invalid_certs</code> or <code>danger_accept_invalid_hostnames</code> to <code>true</code> except in controlled environments such as tests. In production, always ensure certificate and hostname verification are enabled to prevent security risks.
</p>
</recommendation>
@@ -21,7 +21,7 @@ The following code snippet shows a function that creates a TLS or HTTP client wi
</p>
<sample src="DisabledCertificateCheckBad.rs"/>
<p>
While this may be acceptable in a test, it should not be used in production code. Instead, always configure clients to verify certificates and hostnames:
In production code, always configure clients to verify certificates and hostnames:
</p>
<sample src="DisabledCertificateCheckGood.rs"/>
</example>