TLS verification is disabled

Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST Rules > TLS verification is disabled

Metadata

ID: rust-security/tls-verification-disabled

Language: Rust

Severity: Error

Category: Security

CWE: 295

Related CWEs:

Description

Calling danger_accept_invalid_certs(true), danger_accept_invalid_hostnames(true), or their tls_* equivalents on a reqwest::ClientBuilder disables TLS validation, exposing every HTTPS request to man-in-the-middle attacks. The methods are prefixed danger_ as a warning that they should never appear in production code.

Learn More

Non-Compliant Code Examples

use reqwest::ClientBuilder;

fn build_unsafe_certs() -> reqwest::Result<reqwest::Client> {
    ClientBuilder::new()
        .danger_accept_invalid_certs(true)
        .build()
}

fn build_unsafe_hostnames() -> reqwest::Result<reqwest::Client> {
    ClientBuilder::new()
        .danger_accept_invalid_hostnames(true)
        .build()

fn standalone_call(builder: ClientBuilder) -> ClientBuilder {
    builder.danger_accept_invalid_certs(true).something(false)
}

Compliant Code Examples

use reqwest::ClientBuilder;

// Explicitly false (the default)
fn build_safe() -> reqwest::Result<reqwest::Client> {
    ClientBuilder::new()
        .danger_accept_invalid_certs(false)
        .danger_accept_invalid_hostnames(false)
        .build()
}

// No options set
fn build_default() -> reqwest::Result<reqwest::Client> {
    ClientBuilder::new().build()
}