Skip to content

Commit 6d5c233

Browse files
committed
💥 Don't set verify_callback to VerifyCallbackProc
The `VerifyCallbackProc` constant will no longer be automatically assigned to `context.verify_callback`. The callback can still be set explicitly: ``` imap = Net::IMAP.new(host, ssl: {verify_callback: VerifyCallbackProc}) imap.starttls(verify_callback: VerifyCallbackProc) ``` Prior to this commit, if `VerifyCallbackProc` were set (it could be any of `Net::IMAP::VerifyCallbackProc`, `OpenSSL::SSL::VerifyCallbackProc`, `OpenSSL::VerifyCallbackProc`, `Net::VerifyCallbackProc`, or `::VerifyCallbackProc`), it would automatically be assigned to `context.verify_callback`. I can't find any evidence that this constant has ever been set for `net-imap`, `openssl`, or ruby. But it _is_ also used by `net-ftp`. This functionality existed from the beginning of `net-imap`'s TLS support, but was never documented. I don't know the original motivation for this. (Perhaps it's still useful for inserting a debug logger?) But I'm guessing that past motivations for this code are less significant now. Earlier versions of ruby's `openssl` did not have very secure defaults, but the modern `openssl` gem already handles the verify callback just fine.
1 parent 3bba1c0 commit 6d5c233

File tree

1 file changed

+0
-3
lines changed

1 file changed

+0
-3
lines changed

lib/net/imap.rb

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3780,9 +3780,6 @@ def build_ssl_ctx(ssl)
37803780
params = (Hash.try_convert(ssl) || {}).freeze
37813781
context = OpenSSL::SSL::SSLContext.new
37823782
context.set_params(params)
3783-
if defined?(VerifyCallbackProc)
3784-
context.verify_callback = VerifyCallbackProc
3785-
end
37863783
context.freeze
37873784
[params, context]
37883785
else

0 commit comments

Comments
 (0)