From 69160aae61b3dc00a31d5980919d665e02f4c417 Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Sun, 4 Oct 2026 12:46:17 +0300
Subject: http-api-client: T8955: leave warning handling to the caller
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Address the round-2 adversarial-review finding: warnings.catch_warnings()
mutates the process-global filter list for the duration of the block (still
the case on Python 3.13), so scoping suppression inside the library was not
actually isolated.

- http_api_client no longer touches warning filters at all. The
  _suppress_insecure_warning helper is removed and post() calls
  session.post directly again. The unused warnings, contextmanager and
  urllib3 imports are dropped. The class docstring now states that callers
  disabling verification own InsecureRequestWarning handling. The OSError
  wrapping and verify_tls validation are unchanged.
- config_sync ignores InsecureRequestWarning in its __main__ block only,
  before opmode.run(). That one-shot op-mode process deliberately connects
  without verification (verify_tls=False) until T9396. Importing the module
  adds no filter.

🤖 Generated by [robots](https://vyos.io)
---
 python/vyos/http_api_client.py | 39 +++++++++------------------------------
 1 file changed, 9 insertions(+), 30 deletions(-)

(limited to 'python')

diff --git a/python/vyos/http_api_client.py b/python/vyos/http_api_client.py
index 88b09d740..25f22fa1d 100644
--- a/python/vyos/http_api_client.py
+++ b/python/vyos/http_api_client.py
@@ -16,10 +16,7 @@
 # along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 import json
-import warnings
-import urllib3
 import requests
-from contextlib import contextmanager
 from typing import Optional
 from dataclasses import dataclass
 
@@ -27,21 +24,6 @@ from vyos.version import get_version
 from vyos.template import bracketize_ipv6
 
 
-@contextmanager
-def _suppress_insecure_warning(enabled: bool):
-    """Locally ignore urllib3's InsecureRequestWarning when enabled.
-
-    Uses warnings.catch_warnings() so the process-wide filters are restored
-    on exit instead of being changed globally.
-    """
-    if not enabled:
-        yield
-        return
-    with warnings.catch_warnings():
-        warnings.simplefilter('ignore', urllib3.exceptions.InsecureRequestWarning)
-        yield
-
-
 class ApiError(Exception):
     """Generic VyOS HTTP API client error"""
 
@@ -96,6 +78,8 @@ class ApiClient:
     - consistent error handling + typed exceptions
     - secure defaults (verify_tls=True); deployments using self-signed
       certificates opt into verify_tls=False or supply a CA bundle path
+    - no warning-filter changes: callers that disable verification are
+      responsible for handling urllib3's InsecureRequestWarning
     """
 
     _DEFAULT_HEADERS = {
@@ -146,19 +130,14 @@ class ApiClient:
 
         url = f'{self.base_url}{endpoint}'
 
-        # Only silence the insecure-request warning for this call, and only
-        # when verification has been explicitly disabled.
-        insecure = self._cfg.verify_tls is False
-
         try:
-            with _suppress_insecure_warning(insecure):
-                resp = self._session.post(
-                    url,
-                    data=json.dumps(body),
-                    params=params,
-                    timeout=self._cfg.timeout,
-                    verify=self._cfg.verify_tls,
-                )
+            resp = self._session.post(
+                url,
+                data=json.dumps(body),
+                params=params,
+                timeout=self._cfg.timeout,
+                verify=self._cfg.verify_tls,
+            )
         except requests.exceptions.Timeout as e:
             raise ApiTransportError(f'Request timed out: {e}') from e
         except requests.exceptions.RequestException as e:
-- 
cgit v1.2.3