Feature: Enhance Security - #19
Merged
Merged
Conversation
…ement - Replaced basic `curl -sSL` with secure configuration: `curl --proto "=https" --tlsv1.2 -sSf -L` - Added explicit HTTPS-only protocol enforcement (`--proto "=https"`) - Enforced TLS 1.2 minimum version for modern encryption - Used `-sS` (silent but show errors) instead of `-sSL` for better error visibility - Maintained redirect following (`-L`) functionality securely This addresses SonarCloud security vulnerabilities: - S5332: Not enforcing HTTPS might allow insecure redirects - S6506: Allowing downgrades to clear-text protocol is security-sensitive - Provides defense against SSL stripping and protocol downgrade attacks Security improvements: 1. Prevents fallback to insecure HTTP via `--proto "=https"` 2. Enforces modern TLS 1.2+ encryption 3. Maintains security while preserving redirect functionality 4. Better error reporting with `-S` flag for debugging
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With Hardened cURL Configuration Across All Scripts
This pull request implements comprehensive security hardening by upgrading all cURL commands to enforce HTTPS-only connections with explicit TLS version requirements. This addresses critical vulnerabilities identified in SonarCloud analysis related to potential insecure redirects and protocol downgrade attacks.
Changes Implemented:
Security Hardening Pattern: Updated all cURL commands from the basic
curl -sSLpattern to the hardened configuration:curl --proto "=https" --tlsv1.2 -sSf -LFiles Modified: Updated cURL commands in all API interaction scripts.
Security Enhancements:
1. Protocol Enforcement
-sSL(silent, show errors, follow redirects) - allowed HTTP redirects--proto "=https"- explicitly requires HTTPS protocol, preventing HTTP fallback2. TLS Version Control
--tlsv1.2- enforces minimum TLS 1.2 for modern encryption standards3. Error Handling Improvement
-s(silent mode) - suppressed all output including errors-sS(silent but show errors) - maintains quiet operation while exposing critical errors4. Additional Security Flags
-f(--fail) - causes cURL to return error on server errors (4xx, 5xx)-L(--location) - maintains redirect following functionality securelyTechnical Impact:
Vulnerability Mitigation
--proto "=https"prevents downgrade to HTTP via man-in-the-middle attacks--tlsv1.2ensures strong modern encryption, blocking outdated protocolsCompatibility & Performance
-fflag ensures script fails gracefully on API errorsMotivation:
This enhancement directly addresses SonarCloud security findings:
These vulnerabilities represented real risks:
The hardened cURL configuration follows security best practices from:
Testing Validation:
All scripts have been tested to ensure:
This security hardening establishes a foundation for all future external API calls in the project, ensuring that security is built into the transport layer by default.