Disabled TLS Validation (ARCH6119)

Key ruby.security.disabled-tls-validation · Severity error · Category security · CWE CWE-295

Bypassing certificate or hostname validation defeats TLS authentication and enables man-in-the-middle attacks. Always keep validation enabled.

Incorrect

require "net/http"

http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
res = http.get(uri.path)

Correct

require "net/http"

http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
res = http.get(uri.path)

Fix

Use VERIFY_PEER instead of VERIFY_NONE and never disable certificate validation.