Subject: | Net::Google::SafeBrowsing2 uses HTTP for MAC key exchange (and fails) |
Date: | Sun, 02 Jun 2013 11:45:28 +1000 |
To: | bug-CPAN [...] rt.cpan.org |
From: | Fabian Kohn <fko [...] open.ch> |
The current version of Net::Google::SafeBrowsing2 (1.08) uses the
following URL for the exchange of message authentication codes (or
rather, for obtaining a new key) with the Google Safebrowsing API:
http://sb-ssl.google.com/safebrowsing/newkey?client=api&apikey=xxxx&appver=xxx&pver=xxx
However, it doesn't really seem to make sense (security-wise) to
exchange MACs via an unencrypted connection and the Google API
documentation states to use HTTPS in the specifications [1].
What's more (and more important), although the HTTP requests have worked
before, it's not working anymore at present, a call to the above URL,
using a proper api key will yield a 404 error. The same URL via HTTPS
works as expected (With a working API key this can be verified at any
time via curl or even in a browser). I assume that Google stopped
allowing the unencrypted connection, athough I can't confirm this (It
doesn't seem to be a temporary issue, as it has been like this for >
2weeks).
Would it be possible to change the request to use HTTPS in the module
(As the library isn't functioning anymore in it's present state, I would
like this to be treated as urgent if possible)? Since fixing the bug
essentially is only one letter I'm not attaching a patch.
Although this isn't an actual perl related issue, here the environment
information for completeness:
Distribution: Net::Google::SafeBrowsing2-1.08
Perl version: v5.14.0, i686-linux-thread-multi
OS: Linux 2.6.32.52_1 - SMP i386 GNU/Linux
Thanks a lot in advance, best regards,
Fabian
[1]:
https://developers.google.com/safe-browsing/developers_guide_v2#GetKeyRequests