mcp-server-semgrep/semgrep-rules/rust/lang/security/ssl-verify-none.yml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: ssl-verify-none
    message: SSL verification disabled, this allows for MitM attacks
    pattern: "$BUILDER.set_verify(openssl::ssl::SSL_VERIFY_NONE)"
    metadata:
      references:
        - https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify
      technology:
        - openssl
      category: security
      cwe: "CWE-295: Improper Certificate Validation"
      confidence: HIGH
      likelihood: LOW
      impact: MEDIUM
      subcategory: vuln
    languages: [rust]
    severity: WARNING