-
Notifications
You must be signed in to change notification settings - Fork 53
MLE-24397 - fix issue on Linux FIPS reported by consultant/customer a… #963
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR fixes a FIPS compliance issue where MD5 digest algorithms were being loaded by default, causing exceptions in FIPS-enabled Linux environments. The solution incorporates code from the abandoned www-authenticate project directly into the codebase and ensures MD5 is only loaded when actually needed.
- Removes external dependency on www-authenticate package
- Incorporates www-authenticate source code into the project with lazy MD5 loading
- Adds comprehensive FIPS testing to verify MD5 is not loaded during module initialization
Reviewed Changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| package.json | Removes www-authenticate dependency |
| lib/requester.js | Updates import to use local www-authenticate implementation |
| lib/www-authenticate/www-authenticate.js | Main authentication module with digest auth support |
| lib/www-authenticate/user-credentials.js | User credential handling with MD5 digest support |
| lib/www-authenticate/parsers.js | WWW-Authenticate header parsing logic |
| lib/www-authenticate/md5.js | MD5 hash function wrapper |
| test-basic/digestauth-fips-nomd5load.js | FIPS compliance test ensuring MD5 isn't loaded by default |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
…by default load of FIPS-forbidden MD5 digest algorithm. Incorporate the source from the abandoned www-authenticate project and fix in place.
db72383 to
8c9e5ff
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
Copilot reviewed 7 out of 8 changed files in this pull request and generated 2 comments.
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
…round exception caused by default load of FIPS-forbidden MD5 digest algorithm. Incorporate the source from the abandoned www-authenticate project and fix in place.