Skip to content
This repository was archived by the owner on Jul 24, 2024. It is now read-only.

Commit 0a21792

Browse files
sanderson-utsanderson-ut
authored
Set rejectUnauthorized to true by default (#3149)
Resolve CVE-2020-240-25 by setting rejectUnauthorized to true by default. Add configuration flag to override this to false if necessary. extract rejectUnauthorized download option to its own file. Add doc option to README.md.
1 parent e80d4af commit 0a21792

4 files changed

Lines changed: 121 additions & 10 deletions

File tree

‎README.md‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -596,12 +596,13 @@ When compiling a directory `--source-map` can either be a boolean value or a dir
596596

597597
node-sass supports different configuration parameters to change settings related to the sass binary such as binary name, binary path or alternative download path. Following parameters are supported by node-sass:
598598

599-
Variable name | .npmrc parameter | Process argument | Value
600-
-----------------|------------------|--------------------|------
601-
SASS_BINARY_NAME | sass_binary_name | --sass-binary-name | path
602-
SASS_BINARY_SITE | sass_binary_site | --sass-binary-site | URL
603-
SASS_BINARY_PATH | sass_binary_path | --sass-binary-path | path
604-
SASS_BINARY_DIR | sass_binary_dir | --sass-binary-dir | path
599+
Variable name | .npmrc parameter | Process argument | Value
600+
-------------------------|--------------------------|----------------------------|------
601+
SASS_BINARY_NAME | sass_binary_name | --sass-binary-name | path
602+
SASS_BINARY_SITE | sass_binary_site | --sass-binary-site | URL
603+
SASS_BINARY_PATH | sass_binary_path | --sass-binary-path | path
604+
SASS_BINARY_DIR | sass_binary_dir | --sass-binary-dir | path
605+
SASS_REJECT_UNAUTHORIZED | sass_reject_unauthorized | --sass-reject-unauthorized | value
605606

606607
These parameters can be used as environment variable:
607608

@@ -615,6 +616,8 @@ As a process argument:
615616

616617
* E.g. `npm install node-sass --sass-binary-site=http://example.com/`
617618

619+
If you are using self-signed certificates for your binary then `SASS_REJECT_UNAUTHORIZED` will override (rejectUnauthorized)[https://nodejs.org/docs/latest/api/tls.html#tls_tls_createserver_options_secureconnectionlistener].
620+
618621
## Post-install Build
619622

620623
Install runs only two Mocha tests to see if your machine can use the pre-built [LibSass] which will save some time during install. If any tests fail it will build from source.

‎scripts/util/downloadoptions.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
var proxy = require('./proxy'),
2-
userAgent = require('./useragent');
2+
userAgent = require('./useragent'),
3+
rejectUnauthorized = require('./rejectUnauthorized');
34

45
/**
56
* The options passed to request when downloading the bibary
@@ -14,7 +15,7 @@ var proxy = require('./proxy'),
1415
*/
1516
module.exports = function() {
1617
var options = {
17-
rejectUnauthorized: false,
18+
rejectUnauthorized: rejectUnauthorized(),
1819
timeout: 60000,
1920
headers: {
2021
'User-Agent': userAgent(),

‎scripts/util/rejectUnauthorized.js‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
var pkg = require('../../package.json');
2+
3+
/**
4+
* Get the value of a CLI argument
5+
*
6+
* @param {String} name
7+
* @param {Array} args
8+
* @api private
9+
*/
10+
function getArgument(name, args) {
11+
var flags = args || process.argv.slice(2),
12+
index = flags.lastIndexOf(name);
13+
14+
if (index === -1 || index + 1 >= flags.length) {
15+
return null;
16+
}
17+
18+
return flags[index + 1];
19+
}
20+
21+
/**
22+
* Get the value of reject-unauthorized
23+
* If environment variable SASS_REJECT_UNAUTHORIZED is non-zero,
24+
* .npmrc variable sass_reject_unauthorized or
25+
* process argument --sass-reject_unauthorized is provided,
26+
* set rejectUnauthorized to true
27+
* Else set to false by default
28+
*
29+
* @return {Boolean} The value of rejectUnauthorized
30+
* @api private
31+
*/
32+
module.exports = function() {
33+
var rejectUnauthorized = false;
34+
35+
if (getArgument('--sass-reject-unauthorized')) {
36+
rejectUnauthorized = getArgument('--sass-reject-unauthorized');
37+
} else if (process.env.SASS_REJECT_UNAUTHORIZED !== '0') {
38+
rejectUnauthorized = true;
39+
} else if (process.env.npm_config_sass_reject_unauthorized) {
40+
rejectUnauthorized = process.env.npm_config_sass_reject_unauthorized;
41+
} else if (pkg.nodeSassConfig && pkg.nodeSassConfig.rejectUnauthorized) {
42+
rejectUnauthorized = pkg.nodeSassConfig.rejectUnauthorized;
43+
}
44+
45+
return rejectUnauthorized;
46+
};

‎test/downloadoptions.js‎

Lines changed: 63 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ describe('util', function() {
88
describe('without a proxy', function() {
99
it('should look as we expect', function() {
1010
var expected = {
11-
rejectUnauthorized: false,
11+
rejectUnauthorized: true,
1212
timeout: 60000,
1313
headers: {
1414
'User-Agent': ua(),
@@ -33,7 +33,7 @@ describe('util', function() {
3333

3434
it('should look as we expect', function() {
3535
var expected = {
36-
rejectUnauthorized: false,
36+
rejectUnauthorized: true,
3737
proxy: proxy,
3838
timeout: 60000,
3939
headers: {
@@ -57,6 +57,25 @@ describe('util', function() {
5757
delete process.env.HTTP_PROXY;
5858
});
5959

60+
it('should look as we expect', function() {
61+
var expected = {
62+
rejectUnauthorized: true,
63+
timeout: 60000,
64+
headers: {
65+
'User-Agent': ua(),
66+
},
67+
encoding: null,
68+
};
69+
70+
assert.deepStrictEqual(opts(), expected);
71+
});
72+
});
73+
74+
describe('with SASS_REJECT_UNAUTHORIZED set to false', function() {
75+
beforeEach(function() {
76+
process.env.SASS_REJECT_UNAUTHORIZED = '0';
77+
});
78+
6079
it('should look as we expect', function() {
6180
var expected = {
6281
rejectUnauthorized: false,
@@ -70,5 +89,47 @@ describe('util', function() {
7089
assert.deepStrictEqual(opts(), expected);
7190
});
7291
});
92+
93+
describe('with SASS_REJECT_UNAUTHORIZED set to true', function() {
94+
beforeEach(function() {
95+
process.env.SASS_REJECT_UNAUTHORIZED = '1';
96+
});
97+
98+
it('should look as we expect', function() {
99+
var expected = {
100+
rejectUnauthorized: true,
101+
timeout: 60000,
102+
headers: {
103+
'User-Agent': ua(),
104+
},
105+
encoding: null,
106+
};
107+
108+
assert.deepStrictEqual(opts(), expected);
109+
});
110+
});
111+
112+
describe('with npm_config_sass_reject_unauthorized set to true', function() {
113+
beforeEach(function() {
114+
process.env.npm_config_sass_reject_unauthorized = true;
115+
});
116+
117+
it('should look as we expect', function() {
118+
var expected = {
119+
rejectUnauthorized: true,
120+
timeout: 60000,
121+
headers: {
122+
'User-Agent': ua(),
123+
},
124+
encoding: null,
125+
};
126+
127+
assert.deepStrictEqual(opts(), expected);
128+
});
129+
130+
afterEach(function() {
131+
process.env.npm_config_sass_reject_unauthorized = undefined;
132+
});
133+
});
73134
});
74135
});

0 commit comments

Comments
 (0)