Skip Menu |

This queue is for tickets about the Net-Google-SafeBrowsing2 CPAN distribution.

Report information
The Basics
Id: 85796
Status: resolved
Priority: 0/
Queue: Net-Google-SafeBrowsing2

People
Owner: Nobody in particular
Requestors: fko [...] open.ch
Cc:
AdminCc:

Bug Information
Severity: (no value)
Broken in: (no value)
Fixed in: 1.06



Subject: Net::Google::SafeBrowsing2 uses HTTP for MAC key exchange (and fails)
Date: Sun, 02 Jun 2013 11:45:28 +1000
To: bug-CPAN [...] rt.cpan.org
From: Fabian Kohn <fko [...] open.ch>
The current version of Net::Google::SafeBrowsing2 (1.08) uses the following URL for the exchange of message authentication codes (or rather, for obtaining a new key) with the Google Safebrowsing API: http://sb-ssl.google.com/safebrowsing/newkey?client=api&apikey=xxxx&appver=xxx&pver=xxx However, it doesn't really seem to make sense (security-wise) to exchange MACs via an unencrypted connection and the Google API documentation states to use HTTPS in the specifications [1]. What's more (and more important), although the HTTP requests have worked before, it's not working anymore at present, a call to the above URL, using a proper api key will yield a 404 error. The same URL via HTTPS works as expected (With a working API key this can be verified at any time via curl or even in a browser). I assume that Google stopped allowing the unencrypted connection, athough I can't confirm this (It doesn't seem to be a temporary issue, as it has been like this for > 2weeks). Would it be possible to change the request to use HTTPS in the module (As the library isn't functioning anymore in it's present state, I would like this to be treated as urgent if possible)? Since fixing the bug essentially is only one letter I'm not attaching a patch. Although this isn't an actual perl related issue, here the environment information for completeness: Distribution: Net::Google::SafeBrowsing2-1.08 Perl version: v5.14.0, i686-linux-thread-multi OS: Linux 2.6.32.52_1 - SMP i386 GNU/Linux Thanks a lot in advance, best regards, Fabian [1]: https://developers.google.com/safe-browsing/developers_guide_v2#GetKeyRequests