Setup eslint airbnb base and fix errors #408
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const req = request(app); | ||
| await program.parseAsync(['ts-node', './src/fdk.ts', 'login', '--host', 'api.fyndx1.de']); | ||
| return await req.post('/token').send(tokenData); | ||
| process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'; // Disable SSL verification |
Check failure
Code scanning / CodeQL
Disabling certificate validation High test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 months ago
The best way to fix this problem is to avoid globally disabling certificate validation by setting process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'. Instead, use mocking libraries (such as nock or axios-mock-adapter, which is already imported) to intercept and mock HTTP(S) requests in tests, so that no real network requests are made and certificate validation is not an issue. If you must disable certificate validation for a specific request, do so only for that request, not globally.
In this specific case, since axios-mock-adapter is already imported, you should mock the HTTP(S) requests made during the login process, so that no real TLS connections are made and there is no need to disable certificate validation. Remove or comment out the line that sets process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'; in the login function.
Required changes:
- Remove or comment out line 63:
process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'; - Ensure that all network requests in tests are properly mocked (this is already being done with
axios-mock-adapterin the test setup).
| @@ -62,3 +62,3 @@ | ||
| export async function login() { | ||
| process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'; // Disable SSL verification | ||
| // process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'; // Disabled to avoid insecure global SSL configuration | ||
| const port = await getRandomFreePort([]); |
| httpsAgent = { ca }; | ||
| } | ||
| if (process.env.FDK_SSL_NO_VERIFY == 'true') { | ||
| httpsAgent = { rejectUnauthorized: false }; |
Check failure
Code scanning / CodeQL
Disabling certificate validation High
This autofix suggestion was applied.
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 months ago
To fix the issue, we need to ensure that rejectUnauthorized: false is never used in production environments. The best approach is to add a safeguard that checks the application's environment (e.g., NODE_ENV) and throws an error or logs a warning if FDK_SSL_NO_VERIFY is set to 'true' in production. This ensures that disabling certificate validation is restricted to non-production environments.
Steps to implement the fix:
- Add a check for the
NODE_ENVenvironment variable to determine if the application is running in production. - If
NODE_ENVis set to'production'andFDK_SSL_NO_VERIFYis'true', throw an error or log a warning to prevent insecure configurations. - Retain the ability to disable SSL verification in non-production environments for testing purposes.
| @@ -75,2 +75,5 @@ | ||
| if (process.env.FDK_SSL_NO_VERIFY == 'true') { | ||
| if (process.env.NODE_ENV === 'production') { | ||
| throw new Error("Disabling SSL verification is not allowed in production."); | ||
| } | ||
| httpsAgent = { rejectUnauthorized: false }; |
vivek-gofynd
committed this autofix suggestion 5 months ago.
| spinner.start(); | ||
| const isNodeVersionIsGreaterThan18 = +process.version.split('.')[0].slice(1) >= 18; | ||
| const b = exec( | ||
| `node ${VUE_CLI_PATH} build --target lib src/index.js --name ${bundleName}`, |
Check failure
Code scanning / CodeQL
Uncontrolled command line Critical
Co-authored-by: vivekprajapati <[email protected]>
…alidation Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…alidation Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…alidation Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…alidation Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…alidation Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…412) Co-authored-by: Cursor Agent <[email protected]>
No description provided.