christiancompton commented 3 years ago

Recent codescans have flagged these two lines as vulnerabilities, given that https:// should be used. This PR removes these vulnerabilities, so that only retries with https:// will be supported.

Ultimately, all of our users should be using https:// in their service URLs. Any objections to removing http:// retry support? CC: @padamstx @hudlow @rmkeezer

codecov[bot] commented 3 years ago

Codecov Report

Merging #111 (c412b19) into main (ed1c37e) will decrease coverage by 0.00%. The diff coverage is n/a.

@@            Coverage Diff             @@
##             main     #111      +/-   ##
==========================================
- Coverage   98.76%   98.75%   -0.01%     
==========================================
  Files          18       18              
  Lines         726      724       -2     
==========================================
- Hits          717      715       -2     
  Misses          9        9

Impacted Files	Coverage Δ
ibm_cloud_sdk_core/base_service.py	`97.29% <ø> (-0.03%)`	:arrow_down:

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update ed1c37e...c412b19. Read the comment docs.

padamstx commented 3 years ago

@christiancompton I'd like to understand more of the context around this. I can sort of understand the code scanner not wanting us to use http://... but we are merely setting things up IN CASE someone is trying to use an http://-style URL, and we have no control over whether users do that or not. This seems like a false positive to me. Can we just "allow-list" it somehow?

christiancompton commented 3 years ago

Closing - I will address by allowlisting the false positives.

IBM / python-sdk-core

fix: remove http retry support #111

Codecov Report