glsec

Rules / GL042

GL042 TLS certificate verification disabled

Severity: warn
OWASP: CICD-SEC-7 – Insecure System Configuration

What glsec checks

glsec flags script commands and variable assignments that explicitly disable TLS certificate verification. On shared or self-hosted runners, an attacker on the same network can perform a man-in-the-middle attack — intercepting and replacing downloaded artifacts, API responses, or git repository content without leaving any trace.

Detected patterns:

Tool Flag/Setting
curl -k, --insecure
wget --no-check-certificate
git -c http.sslVerify=false
npm --strict-ssl=false, npm config set strict-ssl false
pip --trusted-host (also pip3 / python -m pip)
env var GIT_SSL_NO_VERIFY=true / GIT_SSL_NO_VERIFY=1 (in variables: or inline)

Trigger example

build:
  variables:
    GIT_SSL_NO_VERIFY: "true"
  script:
    - curl -k https://internal.example.com/artifact.tar.gz
    - wget --no-check-certificate https://internal.example.com/file.zip
    - git -c http.sslVerify=false clone https://gitlab.example.com/org/repo.git
    - npm install --strict-ssl=false
    - pip install --trusted-host pypi.org somepkg

Safe alternatives

Add the internal CA certificate to the trust store:

build:
  before_script:
    - cp /path/to/internal-ca.crt /usr/local/share/ca-certificates/
    - update-ca-certificates
  script:
    - curl https://internal.example.com/artifact.tar.gz
    - git clone https://gitlab.example.com/org/repo.git

Pass the CA bundle directly to curl:

build:
  script:
    - curl --cacert "$CI_PROJECT_DIR/certs/internal-ca.crt" https://internal.example.com/artifact.tar.gz

Configure git to use a specific CA:

build:
  script:
    - git config http.sslCAInfo "$CI_PROJECT_DIR/certs/internal-ca.crt"
    - git clone https://gitlab.example.com/org/repo.git

Notes

See also

Enable the ShellCheck integration to surface additional shell issues in these script blocks.

Documentation for glsec 1.23.0. Source of this page · Rule implementation