contrib.nodejsscan.tls_node.node_curl_ssl_verify_disable

profile photo of returntocorpreturntocorp
Author
99
Download Count*
GPLv3
License

SSL Certificate verification for node-curl is disabled.

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: node_curl_ssl_verify_disable
    patterns:
      - pattern: |
          $X(..., {SSL_VERIFYPEER : 0}, ...)
    message: SSL Certificate verification for node-curl is disabled.
    languages:
      - javascript
    severity: ERROR
    metadata:
      owasp: A06:2017 - Security Misconfiguration
      cwe: "CWE-599: Missing Validation of OpenSSL Certificate"
      category: security
      technology:
        - node.js
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]

Examples

tls_node.js

var request = require('request');
var use_key = 'e0ee2bc6d1979f49c6437e27b06a0101';

//corresponding function for each api call to tortuga gateway, allows easy calling and can store user key

module.exports = {

    'status': function (callback) {
        // ruleid:node_tls_reject
        process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0';
        request.get('https://dev.app.idt.net/v1/status?user_key=' + use_key, function (err, response, body) {
            if (err) callback(err);

            var status = JSON.parse(body);
            callback(err, status);
        })
    },
    'fund': function (json, callback) {
        // ruleid:node_tls_reject
        process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
        request.post({
            uri: 'https://dev.app.idt.net/v1/charges?user_key=' + use_key,
            json: json,
            method: 'POST'
        },
            function (err, response, body) {
                if (err) callback(err);

                callback(err, response);
            })

    },
}


var http = require('http');
var curl = require('node-curl');

http.createServer(function (request, response) {

    var url = 'https://url';
    url += request.url;

    console.log(url);


    // ruleid:node_curl_ssl_verify_disable
    curl(url,
        {
            SSL_VERIFYPEER: 0
        },
        function (err) {
            response.end(this.body);
        })

}).listen(8000);