Patched code sample

import ssl
import socket
from thrift.transport.TSocket import TSocket
from thrift.transport.TTransport import TTransportException


class TSSLSocket(TSocket):
    """
    SSL-wrapped TSocket. Simplified to demonstrate a specific vulnerability.
    Based on Apache Thrift Python library.
    """
    def __init__(self, host='localhost', port=9090, ca_certs=None):
        super().__init__(host, port)
        self.ca_certs = ca_certs
        self.handle = None

    def open(self):
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.connect((self.host, self.port))

            context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
            context.load_verify_locations(self.ca_certs)
            context.verify_mode = ssl.CERT_REQUIRED

            # FIX: Hostname checking is explicitly enabled on the SSLContext.
            context.check_hostname = True

            self.handle = context.wrap_socket(
                sock,
                server_hostname=self.host
            )
        except (socket.error, ssl.SSLError) as e:
            self.close()
            raise TTransportException(TTransportException.NOT_OPEN, str(e))