Rules / GL040

GL040 Script downloads over plain FTP

Severity: warn
OWASP: CICD-SEC-6 – Insufficient Credential Hygiene

What glsec checks

glsec flags script lines that contain an ftp:// URL. Plain FTP transmits both credentials (--ftp-user, --ftp-password, or userinfo in the URL) and file contents in cleartext. Any network observer between the runner and the server can capture passwords and downloaded files.

Not flagged:

ftps:// — FTP over TLS (encrypted)
sftp:// — SSH file transfer (encrypted)
curl --ssl-reqd ... ftp:// — curl's explicit TLS upgrade

Trigger example

deploy:
  script:
    - wget --ftp-user="$FTP_USER" --ftp-password="$FTP_PASSWORD" ftp://ftp.example.com/assets.zip

Safe alternatives

Instead of	Use
`ftp://`	`ftps://` (FTP over TLS)
`ftp://`	`sftp://` (SSH-based)
`ftp://`	`https://` if the server supports it
`curl ftp://`	`curl --ssl-reqd ftp://` (explicit TLS)

deploy:
  script:
    - wget ftps://ftp.example.com/assets.zip
    # or
    - curl --ssl-reqd -u "$FTP_USER:$FTP_PASSWORD" ftp://ftp.example.com/assets.zip

References

RFC 4217 — Securing FTP with TLS
GL016: insecure transport (HTTP, git://) in include:remote, scripts, variables
GL038: hardcoded credential literals in script commands

GL040 Script downloads over plain FTP

What glsec checks

Trigger example

Safe alternatives

References

See also