Missing certificate validation check

[frozolotl]

This library does not appear to check whether certificates are valid, as seen here:

• The default is false:

  ai-sdk-cpp/src/http/http_request_handler.h

  Line 19 in 6e8ec01

  bool verify_ssl_cert = false;

• The default is always used:

  ai-sdk-cpp/src/providers/base_provider_client.cpp

  Lines 17 to 19 in 6e8ec01

  	// Initialize HTTP handler with parsed config
  	auto http_config = http::HttpRequestHandler::parse_base_url(config.base_url);
  	http_handler_ = std::make_unique<http::HttpRequestHandler>(http_config);

  and

  ai-sdk-cpp/src/http/http_request_handler.cpp

  Line 14 in 6e8ec01

  HttpConfig HttpRequestHandler::parse_base_url(const std::string& base_url) {

• That value is actually applied:

  ai-sdk-cpp/src/http/http_request_handler.cpp

  Line 84 in 6e8ec01

  cli.enable_server_certificate_verification(config_.verify_ssl_cert);

This is a significant security vulnerability!

Mitigation

I believe you just need to set that boolean to true.