diff --git a/rules/S4830/common/fix/cert-hostname-validation-overlap.adoc b/rules/S4830/common/fix/cert-hostname-validation-overlap.adoc new file mode 100644 index 0000000000..2b8ca3ac2d --- /dev/null +++ b/rules/S4830/common/fix/cert-hostname-validation-overlap.adoc @@ -0,0 +1 @@ +As part of its certification validation, {cert_framework_context} also verifies the server hostname with the certificate chain. diff --git a/rules/S4830/common/fix/code-rationale-setting.adoc b/rules/S4830/common/fix/code-rationale-setting.adoc index 37c1b7be72..85f19dd942 100644 --- a/rules/S4830/common/fix/code-rationale-setting.adoc +++ b/rules/S4830/common/fix/code-rationale-setting.adoc @@ -2,7 +2,3 @@ The certificate validation gets disabled by setting `{cert_variable_name}` to `{cert_variable_unsafe_value}`. To enable validation set the value to `{cert_variable_safe_value}` or do not set `{cert_variable_name}` at all to use the secure default value. - -ifeval::[{cert_hostname_check_builtin} == true] -As part of its certification validation, {cert_framework_context} also verifies the server hostname with the certificate chain. -endif::[] diff --git a/rules/S4830/python/how-to-fix-it/aiohttp.adoc b/rules/S4830/python/how-to-fix-it/aiohttp.adoc index 7877eb0445..1352a188e9 100644 --- a/rules/S4830/python/how-to-fix-it/aiohttp.adoc +++ b/rules/S4830/python/how-to-fix-it/aiohttp.adoc @@ -7,11 +7,13 @@ include::../../common/fix/code-rationale.adoc[] :cert_variable_name: verify_ssl :cert_variable_unsafe_value: False :cert_variable_safe_value: True -:cert_hostname_check_builtin: true -:cert_framework_context: aiohttp include::../../common/fix/code-rationale-setting.adoc[] +:cert_framework_context: aiohttp + +include::../../common/fix/cert-hostname-validation-overlap.adoc[] + ==== Noncompliant code example [source,python,diff-id=41,diff-type=noncompliant] diff --git a/rules/S4830/python/how-to-fix-it/httpx.adoc b/rules/S4830/python/how-to-fix-it/httpx.adoc index ca120096a6..94b6ae9003 100644 --- a/rules/S4830/python/how-to-fix-it/httpx.adoc +++ b/rules/S4830/python/how-to-fix-it/httpx.adoc @@ -7,11 +7,13 @@ include::../../common/fix/code-rationale.adoc[] :cert_variable_name: verify :cert_variable_unsafe_value: False :cert_variable_safe_value: True -:cert_hostname_check_builtin: true -:cert_framework_context: HTTPX include::../../common/fix/code-rationale-setting.adoc[] +:cert_framework_context: HTTPX + +include::../../common/fix/cert-hostname-validation-overlap.adoc[] + ==== Noncompliant code example [source,python,diff-id=31,diff-type=noncompliant] diff --git a/rules/S4830/python/how-to-fix-it/requests.adoc b/rules/S4830/python/how-to-fix-it/requests.adoc index 0ec021351a..92884ee8d0 100644 --- a/rules/S4830/python/how-to-fix-it/requests.adoc +++ b/rules/S4830/python/how-to-fix-it/requests.adoc @@ -7,11 +7,13 @@ include::../../common/fix/code-rationale.adoc[] :cert_variable_name: verify :cert_variable_unsafe_value: False :cert_variable_safe_value: True -:cert_hostname_check_builtin: true -:cert_framework_context: Requests include::../../common/fix/code-rationale-setting.adoc[] +:cert_framework_context: Requests + +include::../../common/fix/cert-hostname-validation-overlap.adoc[] + ==== Noncompliant code example [source,python,diff-id=11,diff-type=noncompliant]