@percy/client 1.32.12-beta.2 → 1.32.12-beta.4

package/dist/trust.js

@@ -0,0 +1,82 @@
+import fs from 'fs';
+import tls from 'tls';
+import crypto from 'crypto';
+import logger from '@percy/logger';
+
+// SHA-256 hashes of the SubjectPublicKeyInfo of root certificates that Node still bundles but that
+// must no longer be trusted. Both chain to eMudhra intermediates whose private keys are publicly
+// known (https://emudhra.we-have-a-problem.com): emSign directly, and AAA Certificate Services via
+// a Sectigo cross-sign. Browsers and operating systems already distrust them.
+export const DISTRUSTED_ROOTS = new Map([['8d417db2dd8bf5e3084d1e3f196d583849d81bdd4c00c70b9d39369e96b8c782', 'emSign ECC Root CA - G3'], ['bd153ed7b0434f6886b17bce8bbe84ed340c7132d702a8f4fa318f756ecbd6f3', 'AAA Certificate Services']]);
+
+// Returns true when a PEM certificate is not one of the distrusted roots. Like Node, certificates
+// that cannot be parsed are not trusted.
+export function isTrustedCertificate(pem) {
+  try {
+    let spki = crypto.createPublicKey(pem).export({
+      type: 'spki',
+      format: 'der'
+    });
+    return !DISTRUSTED_ROOTS.has(crypto.createHash('sha256').update(spki).digest('hex'));
+  } catch (error) {
+    logger('client:trust').debug(`Skipping a CA certificate that cannot be parsed: ${error.message}`);
+    return false;
+  }
+}
+
+// Returns the CA certificates Node trusts by default, without the distrusted roots. Older versions
+// of Node cannot report their defaults, so use the bundled roots plus NODE_EXTRA_CA_CERTS, which
+// Node only adds to its default store and would otherwise be lost when providing an explicit list.
+export function trustedCertificates() {
+  if (tls.getCACertificates) {
+    return tls.getCACertificates('default').filter(isTrustedCertificate);
+  }
+  let extra = [];
+  try {
+    extra = fs.readFileSync(process.env.NODE_EXTRA_CA_CERTS, 'utf-8').match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? [];
+  } catch {}
+  return tls.rootCertificates.concat(extra).filter(isTrustedCertificate);
+}
+
+// Returns true when Node verifies against the OpenSSL store instead of its bundled roots. Distro
+// builds (e.g. Debian and Ubuntu) default to the OpenSSL store, and either default can be switched
+// with --use-openssl-ca or --use-bundled-ca, where the last option wins and command-line options
+// take precedence over NODE_OPTIONS. Unlike these, --use-system-ca adds to the bundled roots.
+export function usesOpenSSLStore(variables = process.config.variables) {
+  let openssl = !!variables.node_use_openssl_ca;
+  let options = [...(process.env.NODE_OPTIONS ?? '').split(/\s+/), ...process.execArgv];
+  for (let option of options) {
+    // Node accepts both dashes and underscores in option names
+    option = option.replace(/_/g, '-');
+    if (option === '--use-openssl-ca') openssl = true;
+    if (option === '--use-bundled-ca') openssl = false;
+  }
+  return openssl;
+}
+
+// Removes the distrusted roots from the CA certificates used by every TLS connection in this
+// process that does not provide its own `ca` option (http, https, proxies, fetch).
+export function dropDistrustedRoots() {
+  // the OpenSSL store is managed by the OS, and OS vendors have removed the distrusted roots
+  if (usesOpenSSLStore()) return;
+
+  // newer versions of Node can replace the default CA certificates directly
+  if (tls.setDefaultCACertificates && tls.getCACertificates) {
+    let current = tls.getCACertificates('default');
+    let trusted = current.filter(isTrustedCertificate);
+    if (trusted.length !== current.length) tls.setDefaultCACertificates(trusted);
+    return;
+  }
+  if (tls.createSecureContext.__percyTrusted) return;
+  let ca = trustedCertificates();
+  let {
+    createSecureContext
+  } = tls;
+  tls.createSecureContext = function (options) {
+    return createSecureContext(options !== null && options !== void 0 && options.ca ? options : {
+      ...options,
+      ca
+    });
+  };
+  tls.createSecureContext.__percyTrusted = true;
+}

package/dist/utils.js

@@ -5,6 +5,10 @@ import path from 'path';
 import crypto from 'crypto';
 import logger from '@percy/logger';
 import { snakecase } from '@percy/config/utils';
+import { dropDistrustedRoots } from './trust.js';
+
+// every network path in the CLI imports these utils, so distrust compromised roots process-wide
+dropDistrustedRoots();
 
 // Formats a raw byte integer as a string
 export function formatBytes(int) {
@@ -305,4 +309,5 @@ export function normalizeBrowsers(browserValues) {
   if (!browserValues) return null;
   return browserValues.map(browser => snakecase(browser));
 }
-export { hostnameMatches, getProxy, ProxyHttpAgent, ProxyHttpsAgent, proxyAgentFor } from './proxy.js';
+export { hostnameMatches, getProxy, ProxyHttpAgent, ProxyHttpsAgent, proxyAgentFor } from './proxy.js';
+export { DISTRUSTED_ROOTS, isTrustedCertificate, trustedCertificates, usesOpenSSLStore, dropDistrustedRoots } from './trust.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@percy/client",
-  "version": "1.32.12-beta.2",
+  "version": "1.32.12-beta.4",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -33,11 +33,11 @@
     "test:coverage": "yarn test --coverage"
   },
   "dependencies": {
-    "@percy/config": "1.32.12-beta.2",
-    "@percy/env": "1.32.12-beta.2",
-    "@percy/logger": "1.32.12-beta.2",
+    "@percy/config": "1.32.12-beta.4",
+    "@percy/env": "1.32.12-beta.4",
+    "@percy/logger": "1.32.12-beta.4",
     "pac-proxy-agent": "^7.0.2",
     "pako": "^2.1.0"
   },
-  "gitHead": "35e95e257d7f09d763698765e429dbae0ce7d5e9"
+  "gitHead": "916cdcd8854848b48c3d658d9d01779176feb2d0"
 }