Zennoxa Shield
Rules / Rust
SHIELD-RUST-013

TLS certificate verification disabled

criticalRustCWE-295CVSS 8.6

What it detects

danger_accept_invalid_certs/hostnames disables TLS validation, enabling MITM.

How to fix

Never disable certificate or hostname verification in production TLS clients.

Vulnerable — Shield flags thisclient.rs
pub fn build_client() -> reqwest::Client {
    // "Fixes" internal self-signed certs by trusting everything.
    reqwest::Client::builder()
        .danger_accept_invalid_certs(true)
        .build()
        .expect("http client")
}
Fixed — scans cleanclient.rs
pub fn build_client() -> reqwest::Client {
    // Certificate and hostname verification stay enabled; trust the
    // internal CA by adding its root certificate instead.
    reqwest::Client::builder()
        .timeout(std::time::Duration::from_secs(10))
        .build()
        .expect("http client")
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUST-013, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUST-013: TLS certificate verification disabled — Zennoxa Shield