stripe/stripe-python — pull request #75 by danielchatfield (2014-05-10 19:32:12+00:00)
Title: Add support for Google App Engine dev server

## Summary
Currently the stripe library is not compatible with the App Engine dev server, this fixes that by disabling the ssl revoked cert check when running on the dev app server.

## More detail
Google App Engine blocks access to many C modules including the `socket` module. It provides its own implementation but this causes a `TypeError` when used with the `ssl` C module.

This PR skips the ssl preflight check when a `TypeError` occurs on the App Engine server, this doesn't add much risk as the attacker would have to be in control of the connection between the user and stripe and also have a copy of the pre-heartbleed ssl private key. In any case the check can be bypassed since connections aren't reused and the check is only done once for the lifetime of an instance so an attacker would simply trigger a stripe request on the target website (buy something with a dummy card) to get the check out the way and then start the MITM attack then trigger another stripe transaction and get the secret key.

## Why catch the exception rather than detect the environment?

If a fix for the underlying issue with the App Engine dev server gets released then the check will work again.

## Feedback

Not sure whether it is appropriate to include a warning here? If so, what should it say?