HttpRequest CGI test in Browser OK, in httpc return null, Why?

Summoning @voltone.

Please don’t use :httpc directly because :ssl.start doesn’t do what the names says it does, aka it doesn’t enforce the verification of the TLS certificates unless you explicitly tell it to do so.

Check this video for more details:

The query should be passed as part of the URL. This should work (and keep your TLS connection secure), assuming you have a CA trust store at the given location:

:ssl.start()
:inets.start()
:httpc.request(:get, {'https://visl.sdu.dk/cgi-bin/visl.pt.cgi?parser=roles&visual=cg-dep&symbol=cg&inputlang=pt&text=olhar', []}, [
  ssl: [
    verify: :verify_peer,
    cacertfile: '/etc/ssl/certs/ca-certificates.crt',
    customize_hostname_check: [
      match_fun: :public_key.pkix_verify_hostname_match_fun(:https)
    ],
  ]
], [])

If you prefer to use a Hex package for your CA trust store, have a look at ‘certifi’ or ‘castore’…

When will OTP fix this security vulnerability? It needs a CVE for them to take action?