search

SpiderClub / haipproxy

:sparkling_heart: High available distributed ip proxy pool, powerd by Scrapy and Redis
https://spiderclub.github.io/haipproxy/
MIT License
5.43k stars 914 forks source link

Cryptographic API Misuse Vulnerability #135

Open lialon opened 1 month ago

lialon commented 1 month ago

Description:

In the "haipproxy/examples/zhihu/crawler.py", I have identified a security vulnerability about insecure Verification. Bypassing certificate verification or accepting all host names are considered insecure.

Location:

https://github.com/SpiderClub/haipproxy/blob/master/examples/zhihu/crawler.py#L64

resp = requests.get(url, headers=self.headers, proxies=proxy, timeout=self.timeout, verify=False)

Reference

Recommendations:

There should be proper verification.