🔒 fix(service): secure Appium service TLS verification - #9
Conversation
Enforce TLS verification when the Appium service URL uses HTTPS. This updates `is_service_listening` to pass `cert_reqs='CERT_REQUIRED'` to `urllib3.PoolManager`. It also optionally passes the `certifi` CA bundle if it is available in the environment.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
Enforce TLS verification when the Appium service URL uses HTTPS. This updates `is_service_listening` to pass `cert_reqs='CERT_REQUIRED'` to `urllib3.PoolManager`. It also optionally passes the `certifi` CA bundle if it is available in the environment. Also fixes type annotations for `_ca_certs` to prevent mypy CI failures.
The previous latest release (0.0.34) of the appium-flutter-server repository no longer has the app-debug.apk and ios.zip release assets, causing CI end-to-end jobs to fail with 404s when attempting to download them. Pinned the asset URLs to the 0.0.33 release where they actually exist to resolve this.
1 participant
🎯 What:
The
urllib3.PoolManagerinstance inis_service_listeninglacked TLS certificate verification, meaning that connections to HTTPS URLs were vulnerable to man-in-the-middle (MITM) attacks because any presented certificate would be implicitly accepted.If an attacker could intercept the connection between the Appium service startup check and the remote service URL when using HTTPS, they could present a fraudulent certificate. This could result in information disclosure or allow an attacker to forge service status responses during the initialization phase, although local Appium instances commonly use HTTP.
🛡️ Solution:
Updated
urllib3.PoolManagerinitialization to includecert_reqs='CERT_REQUIRED'. Additionally, included a fallbacktry...except ImportErrorpattern to importcertifiand pass its CA bundle viaca_certsif present, ensuring it functions gracefully in environments with or without the package.PR created automatically by Jules for task 12885584134159669316 started by @Dor-bl