Skip to content

Adding MRE for node-libcurl insecure SSL rule

Bhavya Kaushal requested to merge node-libcurl into main

SAST Vulnerable MRE Addition

Background Information

This MRE is aimed towards creating a new rule that identifies when the SSL Certificate and Hostname verification for the node-libcurl library is disabled. This is discussed in this thread - gitlab-org/gitlab#440261 (comment 1791115486)

Changes Summary

This MRE adds 2 dockers, one hosting a server which has a self-signed SSL certificate and the other has a client app that connect with the server and hosts code that tests various SSL certificate and hostname verification configurations using the node-libcurl library.

Merge request reports