securesauce / precli

Precaution CLI - command line static application security testing tool
https://precli.readthedocs.io/
Other
22 stars 3 forks source link

Add new rule to check for context=None in FTP_TLS #341

Closed ericwb closed 7 months ago

ericwb commented 7 months ago

Is your feature request related to a problem? Please describe. The default behavior of the FTP_TLS class is to use ssl._create_unverified_context if the context parameter is None. Therefore, a proper context should always be passed.

Describe the solution you'd like Add rule to detect FTP_TLS if context is None.

Suggest fix to use ssl.create_default_context

Describe alternatives you've considered n/a

Additional context

Love this idea? Give it a 👍. We prioritize fulfilling features with the most 👍.