🛡️ Sentinel: [CRITICAL] Fix MITM vulnerability in API requests

🚨 Severity: CRITICAL
💡 Vulnerability: API requests to fetch grades disabled SSL verification (`verify=False`).
🎯 Impact: Attackers could perform Man-In-The-Middle (MITM) attacks to intercept and steal student usernames and passwords during the login process.
🔧 Fix: Removed `verify=False` and warning suppression from all requests in `fetcher.py` to enforce strict SSL certificate validation.
✅ Verification: Review `fetcher.py` to ensure all `requests.get` and `requests.post` calls validate certificates correctly.

Co-authored-by: alvin000009238 <107313913+alvin000009238@users.noreply.github.com>

Author: google-labs-jules[bot]

fetcher.py

@@ -1,10 +1,8 @@
-import urllib3
 from bs4 import BeautifulSoup
 from concurrent.futures import ThreadPoolExecutor
 from app.services.http_client import get_http_session
 
 # Disable insecure request warnings
-urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
 class GradeFetcher:
     BASE = "https://shcloud2.k12ea.gov.tw/CLHSTYC"
@@ -30,7 +28,7 @@ def login_and_get_tokens(username, password):
             s = get_http_session()
 
             # 1) GET login page to obtain cookies + hidden token
-            r = s.get(GradeFetcher.LOGIN_PAGE, verify=False)
+            r = s.get(GradeFetcher.LOGIN_PAGE)
             r.raise_for_status()
             login_token = GradeFetcher._get_hidden_token(r.text)
 
@@ -55,7 +53,7 @@ def login_and_get_tokens(username, password):
                 "__RequestVerificationToken": login_token,
             }
 
-            resp = s.post(GradeFetcher.DO_CHECK, data=data, headers=headers, verify=False)
+            resp = s.post(GradeFetcher.DO_CHECK, data=data, headers=headers)
             resp.raise_for_status()
 
             try:
@@ -71,7 +69,7 @@ def login_and_get_tokens(username, password):
             print("Login OK, fetching grades page for API token...")
 
             # 3) GET grades page to obtain the API-specific __RequestVerificationToken
-            r2 = s.get(GradeFetcher.GRADES_PAGE, verify=False)
+            r2 = s.get(GradeFetcher.GRADES_PAGE)
             r2.raise_for_status()
             api_token = GradeFetcher._get_hidden_token(r2.text)
 
@@ -113,7 +111,7 @@ def get_structure_via_api(cookies, student_no, token):
         try:
             print(f"Requesting structure for {student_no}...")
             session = get_http_session()
-            response = session.post(url, headers=headers, data=data, cookies=cookies, verify=False)
+            response = session.post(url, headers=headers, data=data, cookies=cookies)
             response.raise_for_status()
 
             years_data = response.json()
@@ -179,7 +177,7 @@ def get_exams_via_api(cookies, student_no, token, year_value):
         }
         try:
             session = get_http_session()
-            resp = session.post(url, headers=headers, data=data, cookies=cookies, verify=False)
+            resp = session.post(url, headers=headers, data=data, cookies=cookies)
             if resp.status_code == 200:
                 exams = []
                 for item in resp.json():
@@ -230,7 +228,7 @@ def fetch_grades_via_api(cookies, student_no, token, year_value, exam_value):
 
         try:
             session = get_http_session()
-            response = session.post(url, headers=headers, data=data, cookies=cookies, verify=False)
+            response = session.post(url, headers=headers, data=data, cookies=cookies)
             response.raise_for_status()
             return response.json()
         except Exception as e: