Repository navigation
autofix - #23
autofix#23
Conversation
Update codeql.yml
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| async function downloadCert(host, port = 443, outputFile) { | ||
| return new Promise((resolve, reject) => { | ||
| const socket = tls.connect(port, host, { rejectUnauthorized: false }, () => { |
Check failure
Code scanning / CodeQL
Disabling certificate validation High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
In general, the fix is to stop disabling certificate validation by removing rejectUnauthorized: false so that Node’s default (true) is used, or by explicitly setting rejectUnauthorized: true. If there is a need to connect to servers with custom or self‑signed certificates, that should be handled via a proper trust store (ca option) rather than disabling verification entirely.
For this specific file, the best fix that preserves existing functionality as much as possible while restoring security is:
- Change the
tls.connectcall to use secure defaults by removing the third argument that disables verification and instead passing an options object that does not overriderejectUnauthorized, or sets it explicitly totrue. - Because the current call uses the 3‑argument form (
port, host, options, callback), we can keep that shape and simply remove therejectUnauthorized: falseproperty, optionally replacing it with an empty options object or with other non‑dangerous options if needed later.
Concretely, in bin/checkScripts/downloadCert.js, on line 9, replace:
const socket = tls.connect(port, host, { rejectUnauthorized: false }, () => {with a secure equivalent, such as:
const socket = tls.connect(port, host, {}, () => {or:
const socket = tls.connect(port, host, { rejectUnauthorized: true }, () => {No new methods, imports, or additional definitions are required; we only modify the arguments to tls.connect inside this function.
| @@ -6,7 +6,7 @@ | ||
|
|
||
| async function downloadCert(host, port = 443, outputFile) { | ||
| return new Promise((resolve, reject) => { | ||
| const socket = tls.connect(port, host, { rejectUnauthorized: false }, () => { | ||
| const socket = tls.connect(port, host, {}, () => { | ||
| const cert = socket.getPeerCertificate(); | ||
| if (!cert || !cert.raw) { | ||
| return reject(new Error('Unable to retrieve certificate.')); |
| // Function to download a TLS certificate from a host and save to a file | ||
| const fs = require('fs'); | ||
| const tls = require('tls'); | ||
| const net = require('net'); |
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note
Copilot Autofix
AI 7 months ago
Copilot could not generate an autofix suggestion
Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.
Merge pull request #23 from Ruh-Al-Tarikh/main
This branch was previously deployed
2 participants
No description provided.