Skip to content
This repository has been archived by the owner on Jul 24, 2024. It is now read-only.

Commit

Permalink
Set rejectUnauthorized to true by default
Browse files Browse the repository at this point in the history
Resolve CVE-2020-240-25 by setting rejectUnauthorized to true by default.

Add configuration flag to override this to false if necessary.

Add doc option to README.md
  • Loading branch information
sanderson-ut committed Jul 16, 2021
1 parent 16b8d4b commit 76de3fb
Show file tree
Hide file tree
Showing 3 changed files with 48 additions and 9 deletions.
13 changes: 7 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -595,12 +595,13 @@ When compiling a directory `--source-map` can either be a boolean value or a dir

node-sass supports different configuration parameters to change settings related to the sass binary such as binary name, binary path or alternative download path. Following parameters are supported by node-sass:

Variable name | .npmrc parameter | Process argument | Value
-----------------|------------------|--------------------|------
SASS_BINARY_NAME | sass_binary_name | --sass-binary-name | path
SASS_BINARY_SITE | sass_binary_site | --sass-binary-site | URL
SASS_BINARY_PATH | sass_binary_path | --sass-binary-path | path
SASS_BINARY_DIR | sass_binary_dir | --sass-binary-dir | path
Variable name | .npmrc parameter | Process argument | Value
-------------------------|--------------------------|----------------------------|------
SASS_BINARY_NAME | sass_binary_name | --sass-binary-name | path
SASS_BINARY_SITE | sass_binary_site | --sass-binary-site | URL
SASS_BINARY_PATH | sass_binary_path | --sass-binary-path | path
SASS_BINARY_DIR | sass_binary_dir | --sass-binary-dir | path
SASS_REJECT_UNAUTHORIZED | sass_reject_unauthorized | --sass-reject-unauthorized | value

These parameters can be used as environment variable:

Expand Down
2 changes: 1 addition & 1 deletion scripts/util/downloadoptions.js
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ var proxy = require('./proxy'),
*/
module.exports = function() {
var options = {
rejectUnauthorized: false,
rejectUnauthorized: process.env.NODE_SASS_REJECT_UNAUTHORIZED !== '0',
timeout: 60000,
headers: {
'User-Agent': userAgent(),
Expand Down
42 changes: 40 additions & 2 deletions test/downloadoptions.js
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ describe('util', function() {
describe('without a proxy', function() {
it('should look as we expect', function() {
var expected = {
rejectUnauthorized: false,
rejectUnauthorized: true,
timeout: 60000,
headers: {
'User-Agent': ua(),
Expand All @@ -33,7 +33,7 @@ describe('util', function() {

it('should look as we expect', function() {
var expected = {
rejectUnauthorized: false,
rejectUnauthorized: true,
proxy: proxy,
timeout: 60000,
headers: {
Expand All @@ -57,6 +57,25 @@ describe('util', function() {
delete process.env.HTTP_PROXY;
});

it('should look as we expect', function() {
var expected = {
rejectUnauthorized: true,
timeout: 60000,
headers: {
'User-Agent': ua(),
},
encoding: null,
};

assert.deepStrictEqual(opts(), expected);
});
});

describe('with NODE_SASS_REJECT_UNAUTHORIZED set to false', function() {
beforeEach(function() {
process.env.NODE_SASS_REJECT_UNAUTHORIZED = '0';
});

it('should look as we expect', function() {
var expected = {
rejectUnauthorized: false,
Expand All @@ -70,5 +89,24 @@ describe('util', function() {
assert.deepStrictEqual(opts(), expected);
});
});

describe('with NODE_SASS_REJECT_UNAUTHORIZED set to true', function() {
beforeEach(function() {
process.env.NODE_SASS_REJECT_UNAUTHORIZED = '1';
});

it('should look as we expect', function() {
var expected = {
rejectUnauthorized: true,
timeout: 60000,
headers: {
'User-Agent': ua(),
},
encoding: null,
};

assert.deepStrictEqual(opts(), expected);
});
});
});
});

0 comments on commit 76de3fb

Please sign in to comment.