itispaleocapa / paleobooks

Repository per il progetto paleobooks (app libri usati esperia)
GNU General Public License v3.0
2 stars 0 forks source link

🐛 Disabled cURL SSL verification in AmazonScraper #16

Closed cristianlivella closed 3 years ago

cristianlivella commented 3 years ago

Doing some tests with @Luca10info we encountered an issue doing the requests to the Amazon API; cURL was returning the error number 60, according to the docs it is the error CURLE_PEER_FAILED_VERIFICATION, basically an issue during the verification of the remote server SSL certificate.

The certificate on www.adozionilibriscolastici.it seems to be okay, so probably cURL is missing the CA bundle used by Amazon between its trusted certificates.

To avoid further issues in the future usage of the script, I simply propose to disable the SSL verification in the Amazon scraper. Is not a good practice, but I'm not too woried about man-in-the-middle or other kinds of attack on that domain. We use these APIs just to get the books list, we never send private data, so in the worst scenario we could just get a wrong book list. But I think it is very unlikely that this will happen.