Certificate Validation Disabled

[AndrewX192]

The software disables certificate validation in several places, allowing an attacker who can modify traffic between the Kodi installation and YouTube to MiTM the connection, and observe and tamper with any information sent or received.

    import sys
    # starting with python 2.7.9 urllib verifies every https request
    if False == verify and sys.version_info >= (2, 7, 9):
        import ssl

        ssl_context = ssl.create_default_context()
        ssl_context.check_hostname = False
        ssl_context.verify_mode = ssl.CERT_NONE
        handlers.append(urllib2.HTTPSHandler(context=ssl_context))
        pass

Certificate validation is explicitly turned off for features such as login:

        # url
        url = 'https://www.youtube.com/o/oauth2/token'

        result = requests.post(url, data=post_data, headers=headers, verify=False)
        if result.status_code != requests.codes.ok:
            raise LoginException('Login Failed')

I suspect each instance of verify=False can simply be removed, assuming the system's trust store is properly configured.

[anxdpanic]

I believe simply switching to allow verification will cause issues for mac users and some linux distributions at the very least.
Think it would require a method to reliably find(no idea myself covering all os's) and provide the ca to the ssl context for verification.

[AndrewX192]

Requests provides a default trust store, so different operating systems shouldn't be a problem unless users are using very outdated versions of requests. An alternative would be to include the GeoTrust Global CA certificate which signs *.google.com and youtube.com and set the CA certificate path to that file (verify=/path/to/geotrust.cert)

[anxdpanic]

#116 should for now at least allow users to force verification from Settings - Advanced