contrib.dlint.dlint-equivalent.insecure-requests-use

rules:
  - id: insecure-requests-use
    message: The Python third-party 'requests' module used with SSL verification
      disabled
    languages:
      - python
    severity: WARNING
    metadata:
      source_rule_url: https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO123.md
      category: security
      technology:
        - requests
      references:
        - https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO123.md
      owasp:
        - A02:2021 - Cryptographic Failures
        - A03:2017 - Sensitive Data Exposure
      cwe:
        - "CWE-310: Cryptographic Issues"
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    pattern-either:
      - pattern: requests.request(..., verify=False, ...)
      - pattern: requests.get(..., verify=False, ...)
      - pattern: requests.options(..., verify=False, ...)
      - pattern: requests.head(..., verify=False, ...)
      - pattern: requests.post(..., verify=False, ...)
      - pattern: requests.put(..., verify=False, ...)
      - pattern: requests.patch(..., verify=False, ...)
      - pattern: requests.delete(..., verify=False, ...)