Improper certificate validation
Lack of validation or insufficient validation of a security certificate can lead to host impersonation and sensitive data leaks.
def create_connection_noncompliant():
    import socket
    import ssl
    host, port = 'example.com', 443
    with socket.socket(socket.AF_INET) as sock:
        context = ssl.SSLContext()
        # Noncompliant: security certificate validation disabled.
        context.verify_mode = ssl.CERT_NONE
        conn = context.wrap_socket(sock, server_hostname=host)
        try:
            conn.connect((host, port))
            handle(conn)
        finally:
            conn.close()
def create_connection_compliant():
    import socket
    import ssl
    host, port = 'example.com', 443
    with socket.socket(socket.AF_INET) as sock:
        context = ssl.SSLContext()
        # Compliant: security certificate validation enabled.
        context.verify_mode = ssl.CERT_REQUIRED
        conn = context.wrap_socket(sock, server_hostname=host)
        try:
            conn.connect((host, port))
            handle(conn)
        finally:
            conn.close()