This repository was archived by the owner on Feb 18, 2025. It is now read-only.
Fix process crash (!) when no certificate is present (can be considered a vulnerability) #108
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
It can be that the certificate is just not returned by the server for
https
connections (port 443):The weirdest part is, it crashes the entire NodeJS process when using your package, i.e. all programs using this package are vulnerable:
The above error is a process-level error, and there is no way to catch it (but only globally). I suspect NodeJS is also not handling errors in the
https.request
callback correctly, but I can't invest too much time to investigate it, rather I am suggesting a quick fix. The root cause of the problem is.getPeerCertificate()
returning{}
. I also didn't find any suitable domain athttps://badssl.com
to write the test which reproduces it, but you can reproduce it easily by adding athrow new Error('whatever')
inside thehttps.request
's callback.Thanks for a great package! Looking forward to seeing this fix on npm.
P.S. If you want this PR to count towards my Hacktoberfest contributions, please add a
hacktoberfest-accepted
label to it. Thanks!