sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

[medium] semgrep: Dangerously accepting invalid TLS information #26

New Issue
Closed
opened 2026-03-18 16:01:23 +00:00 by sharang · 1 comment
sharang commented 2026-03-18 16:01:23 +00:00
Owner
Copy Link
Copy Source

medium Finding

Scanner: semgrep
Severity: medium
Rule: rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid
CWE: CWE-295: Improper Certificate Validation

Description

Dangerously accepting invalid TLS information

Location

File: /tmp/compliance-scanner/repos/Compliance Scanner/compliance-dast/src/tools/cookie_analyzer.rs (line 227)

Code

requires login

Fingerprint: 329ce8ca4fdf5b0028bf5bae36cc6869252f3b1547b12f25eeb9f62169f4227e
Generated by compliance-scanner

Labels: severity:medium, scanner:semgrep, compliance-scanner

## medium Finding **Scanner:** semgrep **Severity:** medium **Rule:** rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid **CWE:** CWE-295: Improper Certificate Validation ### Description Dangerously accepting invalid TLS information ### Location **File:** `/tmp/compliance-scanner/repos/Compliance Scanner/compliance-dast/src/tools/cookie_analyzer.rs` (line 227) ### Code ``` requires login ``` --- *Fingerprint:* `329ce8ca4fdf5b0028bf5bae36cc6869252f3b1547b12f25eeb9f62169f4227e` *Generated by compliance-scanner* **Labels:** severity:medium, scanner:semgrep, compliance-scanner
sharang commented 2026-07-10 07:52:25 +00:00
Author
Owner
Copy Link
Copy Source

Closing as intentional: compliance-dast is a security scanner and must be able to probe targets with self-signed/invalid certificates, so danger_accept_invalid_certs(true) is by design. It analyzes targets; it does not carry trusted user traffic.

Closing as intentional: compliance-dast is a security scanner and must be able to probe targets with self-signed/invalid certificates, so `danger_accept_invalid_certs(true)` is by design. It analyzes targets; it does not carry trusted user traffic.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#26