Description
In verify.py:29, repository URLs resolved from PyPI metadata or deps.dev are not validated to use HTTPS. An http:// URL would be cloned without TLS, making the clone vulnerable to man-in-the-middle attacks.
The pypi.py regex (_VCS_HOST_RE) matches both http:// and https:// URLs without distinction:
_VCS_HOST_RE = re.compile(
r"https?://(?:github\.com|gitlab\.com|bitbucket\.org)/[^/]+/[^/]+"
)Suggested fix
Either:
- Reject non-HTTPS repository URLs at verification time
- Automatically upgrade
http:// to https:// for known VCS hosts
- At minimum, warn the user when cloning over plain HTTP
Description
In
verify.py:29, repository URLs resolved from PyPI metadata or deps.dev are not validated to use HTTPS. Anhttp://URL would be cloned without TLS, making the clone vulnerable to man-in-the-middle attacks.The
pypi.pyregex (_VCS_HOST_RE) matches bothhttp://andhttps://URLs without distinction:Suggested fix
Either:
http://tohttps://for known VCS hosts