mirror of
https://github.com/calibrain/shelfmark.git
synced 2026-11-14 10:28:39 +00:00
splitsec2
84d1d7196c
CodeQL on my fork flagged `ssl.create_default_context()` in the IRC client as allowing TLS 1.0 and 1.1 (`py/insecure-protocol`, rated high). In practice the shipped image is already fine. Python 3.10+ sets a TLS 1.2 floor on the default context, and on the current image (Python 3.14.7, OpenSSL 3.5.7) `minimum_version` comes back as TLS 1.2. An OpenSSL config on the host can still lower that floor, so this pins it with one line, `context.minimum_version = ssl.TLSVersion.TLSv1_2`. Added `tests/irc/test_client_tls.py`. It drops the floor to the minimum before `connect()` runs, then checks that `connect()` raised it back to 1.2. It fails without the change. Certificate and hostname verification are still off (`CERT_NONE`). I left that alone because of the comment about self-signed certs on IRC servers. Turning verification on, or making it a setting, would be the bigger fix, but that is ultimately a call for @calibrain if you want a PR for it.
34 lines
1.1 KiB
Python
34 lines
1.1 KiB
Python
"""The IRC TLS context must not allow anything older than TLS 1.2."""
|
|
|
|
import ssl
|
|
|
|
import pytest
|
|
|
|
from shelfmark.release_sources.irc.client import IRCClient, IRCConnectionError
|
|
|
|
|
|
def test_tls_context_refuses_tls_1_0_and_1_1(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
contexts: list[ssl.SSLContext] = []
|
|
real_create = ssl.create_default_context
|
|
|
|
def capture(*args, **kwargs) -> ssl.SSLContext:
|
|
context = real_create(*args, **kwargs)
|
|
# Allow everything first, so the test fails if connect() does not raise the floor
|
|
context.minimum_version = ssl.TLSVersion.MINIMUM_SUPPORTED
|
|
|
|
def refuse(*_args, **_kwargs):
|
|
raise OSError("no network in tests")
|
|
|
|
context.wrap_socket = refuse # type: ignore[method-assign]
|
|
contexts.append(context)
|
|
return context
|
|
|
|
monkeypatch.setattr(ssl, "create_default_context", capture)
|
|
client = IRCClient(nick="reader", server="irc.example.test", port=6697, use_tls=True)
|
|
|
|
with pytest.raises(IRCConnectionError):
|
|
client.connect()
|
|
|
|
assert len(contexts) == 1
|
|
assert contexts[0].minimum_version == ssl.TLSVersion.TLSv1_2
|