Cryptographic API Misuse Vulnerability

[lialon]

Description:

In the "haipproxy/examples/zhihu/crawler.py", I have identified a security vulnerability about insecure Verification. Bypassing certificate verification or accepting all host names are considered insecure.

Location:

https://github.com/SpiderClub/haipproxy/blob/master/examples/zhihu/crawler.py#L64

resp = requests.get(url, headers=self.headers, proxies=proxy, timeout=self.timeout, verify=False)

Reference

• CWE-295: Improper Certificate Validation

Recommendations:

There should be proper verification.