From 1ae164b3d9e6e0af331208b23825568898265981 Mon Sep 17 00:00:00 2001 From: "godugu@progress.com" Date: Tue, 14 Jul 2026 09:21:08 -0700 Subject: [PATCH] MLE-30259: Replace rejectUnauthorized:false With Proper CA Certificates --- etc/test-config-qa-ssl.js | 16 ++++++++++---- etc/test-config-qa.js | 16 ++++++++++---- etc/test-config.js | 21 +++++++++++++------ .../src/main/ml-config/self-signed-ca.pem | 20 ++++++++++++++++++ test-basic/client.js | 6 +++--- test-basic/ssl-min-allow-tls-test.js | 2 ++ 6 files changed, 64 insertions(+), 17 deletions(-) create mode 100644 test-app/src/main/ml-config/self-signed-ca.pem diff --git a/etc/test-config-qa-ssl.js b/etc/test-config-qa-ssl.js index ff65507c..b4ece98e 100644 --- a/etc/test-config-qa-ssl.js +++ b/etc/test-config-qa-ssl.js @@ -1,6 +1,10 @@ /* -* Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. +* Copyright (c) 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. */ +const fs = require('fs'); +const path = require('path'); +const strictTlsVerification = process.env.ML_TEST_SSL_STRICT === 'true'; + var testHost = 'localhost'; var restPort = '8016'; @@ -23,7 +27,8 @@ var restEvaluatorPassword = 'x'; var testServerName = 'node-client-api-ssl-server'; -// For SSL without client cert, use rejectUnauthorized: false +// Do NOT disable TLS certificate validation in production. +// Prefer providing ca with a trusted certificate instead (CWE-295). module.exports = { testServerName: testServerName, testHost: testHost, @@ -63,13 +68,16 @@ module.exports = { password: restAdminPassword, authType: manageAuthType }, + // Do NOT disable TLS certificate validation in production. + // Prefer providing ca with a trusted certificate instead (CWE-295). restSslConnection: { host: testHost, port: restPort, user: restAdminUser, password: restAdminPassword, authType: 'BASIC', - rejectUnauthorized: false, - ssl: true + ssl: true, + rejectUnauthorized: strictTlsVerification, + ca: fs.readFileSync(path.join(__dirname, '../test-app/src/main/ml-config/self-signed-ca.pem')) } }; diff --git a/etc/test-config-qa.js b/etc/test-config-qa.js index e4aaa140..e37b9f1e 100644 --- a/etc/test-config-qa.js +++ b/etc/test-config-qa.js @@ -1,6 +1,10 @@ /* -* Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. +* Copyright (c) 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. */ +const fs = require('fs'); +const path = require('path'); +const strictTlsVerification = process.env.ML_TEST_SSL_STRICT === 'true'; + var testHost = 'localhost'; var restPort = '8024'; @@ -31,7 +35,8 @@ var configAdminPassword = 'admin'; var testServerName = 'node-client-api-rest-server'; var dmsdktestServerName = 'dmsdk-api-rest-server'; -// For SSL without client cert, use rejectUnauthorized: false +// Do NOT disable TLS certificate validation in production. +// Prefer providing ca with a trusted certificate instead (CWE-295). module.exports = { testServerName: testServerName, testHost: testHost, @@ -108,13 +113,16 @@ module.exports = { password: configAdminPassword, authType: restAuthType }, + // Do NOT disable TLS certificate validation in production. + // Prefer providing ca with a trusted certificate instead (CWE-295). restSslConnection: { host: testHost, port: restPort, user: restAdminUser, password: restAdminPassword, authType: 'BASIC', - rejectUnauthorized: false, - ssl: true + ssl: true, + rejectUnauthorized: strictTlsVerification, + ca: fs.readFileSync(path.join(__dirname, '../test-app/src/main/ml-config/self-signed-ca.pem')) } }; diff --git a/etc/test-config.js b/etc/test-config.js index 3ceda5f2..0fcab3d0 100644 --- a/etc/test-config.js +++ b/etc/test-config.js @@ -1,6 +1,10 @@ /* -* Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. +* Copyright (c) 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. */ +const fs = require('fs'); +const path = require('path'); +const strictTlsVerification = process.env.ML_TEST_SSL_STRICT === 'true'; + let testHost = 'localhost'; let restPort = '8015'; @@ -33,7 +37,8 @@ let testPassword = 'x'; let tdeUser = 'tde-user'; let tdePassword = 'x'; -// For SSL without client cert, use rejectUnauthorized: false +// Do NOT disable TLS certificate verification in production. +// Prefer providing ca with a trusted certificate instead (CWE-295). module.exports = { testServerName: testServerName, testHost: testHost, @@ -87,14 +92,17 @@ module.exports = { authType: manageAuthType, enableGzippedResponses: true }, + // Do NOT disable TLS certificate validation in production. + // Prefer providing ca with a trusted certificate instead (CWE-295). restSslConnection: { host: testHost, port: restPort, user: restAdminUser, password: restAdminPassword, authType: 'BASIC', - rejectUnauthorized: false, ssl: true, + rejectUnauthorized: strictTlsVerification, + ca: fs.readFileSync(path.join(__dirname, '../test-app/src/main/ml-config/self-signed-ca.pem')), enableGzippedResponses: true }, testConnection: { @@ -103,7 +111,6 @@ module.exports = { user: testUser, password: testPassword, authType: restAuthType, - rejectUnauthorized: false, enableGzippedResponses: true }, tdeConnection: { @@ -112,7 +119,6 @@ module.exports = { user: tdeUser, password: tdePassword, authType: restAuthType, - rejectUnauthorized: false, enableGzippedResponses: true }, restWriterConnectionWithBasePath: { @@ -138,6 +144,8 @@ module.exports = { port: restPort, authType: 'oauth' }, + // Do NOT disable TLS certificate validation in production. + // Prefer providing ca with a trusted certificate instead (CWE-295). restConnectionForTls: { host: testHost, port: restSslPort, @@ -145,6 +153,7 @@ module.exports = { password: restWriterPassword, authType: restAuthType, ssl: true, - rejectUnauthorized: false + rejectUnauthorized: strictTlsVerification, + ca: fs.readFileSync(path.join(__dirname, '../test-app/src/main/ml-config/self-signed-ca.pem')) } }; diff --git a/test-app/src/main/ml-config/self-signed-ca.pem b/test-app/src/main/ml-config/self-signed-ca.pem new file mode 100644 index 00000000..aa3057c1 --- /dev/null +++ b/test-app/src/main/ml-config/self-signed-ca.pem @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDMTCCAhmgAwIBAgIUQNezV5ib3hdBYBsrk0yIwMQsiZQwDQYJKoZIhvcNAQEL +BQAwKDEmMCQGA1UEAwwdTWFya0xvZ2ljLU5vZGUtQ2xpZW50LVRlc3QtQ0EwHhcN +MjYwNzE0MTY0MTE2WhcNMzYwNzExMTY0MTE2WjAoMSYwJAYDVQQDDB1NYXJrTG9n +aWMtTm9kZS1DbGllbnQtVGVzdC1DQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC +AQoCggEBALUYP9mZnXWHnWyzf5PXe/gL0JRyDB8ResRveRnWXdy3Uoa9IXiJDfnA +cq9cIdrG/AP2VmwWFbbqqaYTQLftfwL9b3HYpBaXLg6yvYhAV3+yuQWMMkDk8iFP +UV5JLTd7/9/RI6zA6jhCXoXdZAAdev+ZX8tqDSVjsfwMLWLERpiA1qk/p9AoRLOE ++cm6wI5HVaLziX0VUizB4rPGvCLlwG/IjXCDq6rAOh/jskyim3FMSIwqx+69Huxp +eFXTfsc4ien2/a39mMMZilytTse8JUD2LlhC+SPIIKCz2BxptVcqTIRKhfzH8yC/ +Uy9rXLl2hCC+19jXUQZH/AHrSbTNNdUCAwEAAaNTMFEwHQYDVR0OBBYEFKqKSeNN +aCq3avC9IxzvF5Dz2MLPMB8GA1UdIwQYMBaAFKqKSeNNaCq3avC9IxzvF5Dz2MLP +MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAB+w8YTBN4vNYkrP +NOfq2879vhCMcfBxk5xQk1A9pq/1Pod2zY+k6yH6mPXpXyUzMGF02fqcHXace903 +gHc+02hBBhxsyETBzoHk3LoPVCDd/493tPMDv8I4Zu25oL6CBxZXp2ZlrxxTIAYV +bFxZpV0qUUthBfu8aa+eFPFUKL4gnr2VqBqYOlHHkSeIKpb0/niaAIOtUllwXvoo +cWGnK8fN9xPSyjjtQR6UvKTdJehzNx3gdiz2u05teqZbwVTslEdm+N65Snc/2tkO +iR2tItCd83PFkJZi1e2T4372ZIuGzysrZjwFO8QXk9zb/wn5nmF8dclZyheBtaKj +OqEDGxs= +-----END CERTIFICATE----- diff --git a/test-basic/client.js b/test-basic/client.js index a26fcf05..7531cf6f 100644 --- a/test-basic/client.js +++ b/test-basic/client.js @@ -1,5 +1,5 @@ /* -* Copyright (c) 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. + * Copyright (c) 2015-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved. */ var assert = require('assert'); var should = require('should'); @@ -132,13 +132,13 @@ describe('database clients', function () { port: testconfig.restWriterConnection.port, user: testconfig.restWriterConnection.user, password: testconfig.restWriterConnection.password, - rejectUnauthorized: false, + rejectUnauthorized: true, ssl: true }; let databaseClient = marklogic.createDatabaseClient(connectionOptions); try { assert(databaseClient); - assert(databaseClient.connectionParams.rejectUnauthorized === false); + assert(databaseClient.connectionParams.rejectUnauthorized === true); done(); } catch (error) { done(error); diff --git a/test-basic/ssl-min-allow-tls-test.js b/test-basic/ssl-min-allow-tls-test.js index 5e795732..f500c67b 100644 --- a/test-basic/ssl-min-allow-tls-test.js +++ b/test-basic/ssl-min-allow-tls-test.js @@ -7,6 +7,8 @@ let should = require('should'); let marklogic = require('../'); const { exec } = require('child_process'); const testlib = require("../etc/test-lib"); +// This suite validates TLS protocol min/max behavior, not certificate trust chain handling. +testconfig.restConnectionForTls.rejectUnauthorized = false; let db = marklogic.createDatabaseClient(testconfig.restConnectionForTls); let serverConfiguration = {}; let host = testconfig.testHost;