Merge pull request #3124 from snyk/test/https

test: https connections

test/acceptance/fake-server.ts

@@ -2,6 +2,7 @@ import * as bodyParser from 'body-parser';
 import * as express from 'express';
 import * as fs from 'fs';
 import * as http from 'http';
+import * as https from 'https';
 import * as path from 'path';
 import { getFixturePath } from '../jest/util/getFixturePath';
 
@@ -23,6 +24,10 @@ export type FakeServer = {
   setFeatureFlag: (featureFlag: string, enabled: boolean) => void;
   unauthorizeAction: (action: string, reason?: string) => void;
   listen: (port: string | number, callback: () => void) => void;
+  listenWithHttps: (
+    port: string | number,
+    options: https.ServerOptions,
+  ) => Promise<void>;
   restore: () => void;
   close: (callback: () => void) => void;
   getPort: () => number;
@@ -479,7 +484,23 @@ export const fakeServer = (basePath: string, snykToken: string): FakeServer => {
   });
 
   const listen = (port: string | number, callback: () => void) => {
-    server = app.listen(Number(port), callback);
+    server = http.createServer(app).listen(Number(port), callback);
+  };
+
+  const listenWithHttps = (
+    port: string | number,
+    options: https.ServerOptions,
+  ): Promise<void> => {
+    return new Promise((resolve, reject) => {
+      server = https.createServer(options, app);
+      server.once('listening', () => {
+        resolve();
+      });
+      server.once('error', (err) => {
+        reject(err);
+      });
+      server.listen(Number(port));
+    });
   };
 
   const close = (callback: () => void) => {
@@ -509,6 +530,7 @@ export const fakeServer = (basePath: string, snykToken: string): FakeServer => {
     setFeatureFlag,
     unauthorizeAction,
     listen,
+    listenWithHttps,
     restore,
     close,
     getPort,

test/fixtures/fake-server/localhost-expired.cert

@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFjTCCA3WgAwIBAgIUPnXIRAGiCjwBFH3tf7WewZ2tztwwDQYJKoZIhvcNAQEL
+BQAwVjELMAkGA1UEBhMCVVMxDzANBgNVBAgMBkRlbmlhbDEUMBIGA1UEBwwLU3By
+aW5nZmllbGQxDDAKBgNVBAoMA0RpczESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTIy
+MDQwNTE0Mzc1NloXDTIyMDQwNjE0Mzc1NlowVjELMAkGA1UEBhMCVVMxDzANBgNV
+BAgMBkRlbmlhbDEUMBIGA1UEBwwLU3ByaW5nZmllbGQxDDAKBgNVBAoMA0RpczES
+MBAGA1UEAwwJbG9jYWxob3N0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
+AgEA3VCaclt4geO6NJLqJv5VGRhHbvNRyMxgrBBEzzRxRmsrfYo6L08gn2L7Vc8u
+16w9Mylx7ORMgvekAW6Np8XJU32R2nGr4oX14ChihT/BKjF0IGPGsPtvsGehI/dY
+52ArUPjq57kAkDnwr4hHhxraQsLRuInpKw48JeIO9nRwxUvT53KXr2TauTt13tom
+gnDdgE8QzCxEuxXl9To/ziDJrwJcbrzISuosIQBNYC3pFIBRbuIthk3PmPyX3DLk
+OIWBTcumQKC4G5/SDb1/UmFvq7oC8c1dMGsDrpni4kJ7K6voFSQB057jQZcQW2vh
+h24ZQsQv8sTFTnyzgxCh4PyOai/XMxSRaAaYyd98o4nzoFT3o/zA4Wzp0I/Hzz3X
+Yzj+1VCR2ulJmkXs+UtlXEAmbG5QoHu5Rehbm/cn0zT+CVhcxV4IiOYIHAotgQfr
+8/97+0JPn1kLktm1s5OqwMFr3SYSDiolJnmXdeA3VLhm9ACS0CsMXUQ5t5yeHP43
+MS35Zf+PGKKlj3r9liBrjGzS1VAHKJm/OFpoJdGbNcL7gjax3o6fYALu+phD4EMy
+La3RFAX2vpXuxvSWfN67c1WtS7CnkIdfrYEftputRFHv72Z4lwXXRPfnEmCcpdGU
+2SimuuLviO15iTgwbsWyZyWZVo4EgFbgzxnyUwQiFyHZJT0CAwEAAaNTMFEwHQYD
+VR0OBBYEFDSO8Fn6VyCweAt5RrKvpwFxHa/8MB8GA1UdIwQYMBaAFDSO8Fn6VyCw
+eAt5RrKvpwFxHa/8MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIB
+AJGo+FygzteAayjnjeX8aCIeqFyVPl6p38GHvX3paYc4nGEQ0kDcmwU7U7Eh13BF
+V9gENnhdVCCBkP/WXdEJVSZ4O/f5LjmJlaopMWcgEETtQCoDUfEtP12X/9JC9MyP
+1OVkdTOtu4DrmPWjF8vG1npetlx46FsOORVohg2IBtJh10zNrhs/AcrQ/H8+3Pb8
+E4lFwpTRZQKyQA/SRlex0vKDTgKbVyB/Bflk9YujISbE4J7URlGf/Ah6DU83/SFQ
+Un9x2eioEz2Zqqqidf3WtGb33Krp3x0I7aKKxWepQkp8KcYNY76boJTiSle8rGEi
+++Mm2tEKmPhoPaSbetlOBp4M4ZF+Ncqih2fjbVI1a8g73mkcBVJOWYNc5YAVyrOP
+/HxIrSJ+rOX5EO4ysxa2qwSk9pUGCzrfAfyZmTW2D3WFZl5Wz1wV+0SQYaKysWTJ
+p+8v74M+u9/w3Bse7hUJtnUjEF0WQX3uA1hNOKgfAYnTOElO2PpaKgnw2MgBtlcA
+pxMTHskeN5GtkPY2s2u+cGHI/6B8WpJYV39RB39692QT+X5yiPt4kWHaEYVS1B+K
+NF3MleN7SlqkdhUbJ0frFXdopmQSP1xjcIsPtkwlLzQUX++Vg+BQli4IMwFwtntL
+QSngAiAPDc9URvHFQ8vIeSnAqsbIyDttu/49Qvbfdc07
+-----END CERTIFICATE-----

test/fixtures/fake-server/localhost-expired.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDdUJpyW3iB47o0
+kuom/lUZGEdu81HIzGCsEETPNHFGayt9ijovTyCfYvtVzy7XrD0zKXHs5EyC96QB
+bo2nxclTfZHacavihfXgKGKFP8EqMXQgY8aw+2+wZ6Ej91jnYCtQ+OrnuQCQOfCv
+iEeHGtpCwtG4iekrDjwl4g72dHDFS9PncpevZNq5O3Xe2iaCcN2ATxDMLES7FeX1
+Oj/OIMmvAlxuvMhK6iwhAE1gLekUgFFu4i2GTc+Y/JfcMuQ4hYFNy6ZAoLgbn9IN
+vX9SYW+rugLxzV0wawOumeLiQnsrq+gVJAHTnuNBlxBba+GHbhlCxC/yxMVOfLOD
+EKHg/I5qL9czFJFoBpjJ33yjifOgVPej/MDhbOnQj8fPPddjOP7VUJHa6UmaRez5
+S2VcQCZsblCge7lF6Fub9yfTNP4JWFzFXgiI5ggcCi2BB+vz/3v7Qk+fWQuS2bWz
+k6rAwWvdJhIOKiUmeZd14DdUuGb0AJLQKwxdRDm3nJ4c/jcxLfll/48YoqWPev2W
+IGuMbNLVUAcomb84Wmgl0Zs1wvuCNrHejp9gAu76mEPgQzItrdEUBfa+le7G9JZ8
+3rtzVa1LsKeQh1+tgR+2m61EUe/vZniXBddE9+cSYJyl0ZTZKKa64u+I7XmJODBu
+xbJnJZlWjgSAVuDPGfJTBCIXIdklPQIDAQABAoICAGzZXO0L0gxIXefHrkR5aI9M
+Iq4OHFZfNtjJs54Zk/Dnet9m4dEs4MWjoCwHF2nZ+8uzAaZabssnU1Gk9yTiIW/f
+3aGLsNdbvZ9/HV2eCrpe0lev2yRmtfsULOwMlnxOD1/m3VoU4pMM/DTJGSz45wpY
+2V8i7TxQ5wJW2bcbc++FqPY3pSUNvInIFeQCdVhIfJjDymYxC6jcT1q6SHFwLOHX
+jnCkhvpZjFS62lOIoQ+FQQgBVBSvJoB/E42othiaiQsjM2Sr54EmrOA3KGzzIUJb
+3WDh+Yh7ybbRVwajXgMPrLjhGcjkZ691xgTA3Y6HdwMgjNihMM22hW/b+VI3xS7I
+ho5FcKrGGHTY+88IPcwVffd6TWHJbOdBEvBKjn+3rjutPH4CtThtS9Lqav3TtvnV
+v/q54knIMfis4lmNHubFNv+8JKyJyBHdTZrXgUzKgmuuywOtEpHG6SDDKlCW6O5z
+Aw+ek6QdvnDP7vRput8kr6lU16YZ5f0QUhxeZPJTtOnBZWY6Hub0WiARkHCrJiME
+UU8UuWkHQgZLLorln+x2X2hakeDSdku3HxrEwMjCPshTggmmQaQbEd7lP5Q0e6IB
+FG3Hhfhd01iYkmFIUlNuJIhwh0td+nVaH/spabarZ8b0/J++1bmf124bKDA2aWwr
+yUyAuat70Rvc4xoxaCE9AoIBAQD27OJR6SLbWOU5EVvMweg5nNQBY1ENqUjvL7i8
+yjUHEJPuaaOMX7r/cAv+0FPL7fLGSZ6sOCI9o7UkF2wiWlzdTHD6Pcaf56+IIyEH
+iuw8cKJWLx98sOV10q9t69OXR/kSMHEFob6ZVuwfIIqtfUTHr7txHI72c9rmjxOH
+Tjdw+PAMHELdqNzZ527mnRf04NLCChF/rrLvLQqdu9egZ64zPAOc/EkynafR/xdy
+w3k3LfjP21EvbbtjHCSEYFaLppO/xaQdDEm6Tp6NN3U4BOQZgvrejf0LNC1eab2f
+dcJEfQpaPCD2b24nP429Z6xWzzfIJbnVi06G66bo3mBsCWdrAoIBAQDlcsWCpNZk
+t6E5ualQ75L9pIYiKgK3kEOIBPzxOG5sBSZcRUZTDCxfs9BI04Uj9WYzQU6IdCQB
+KbTADun62VT5E3ursHLxpBWDsFNVNU5qvdibYZ0UTgrhsQfgwGXN7W25UAtyReVm
+IPzFEeTjwXNPW2OKWO/U0BucVzGt/IwZcFaj9kv+FRRjLTrWZfEr/OvUF3J34aoR
+Eij08rC9gb4/5r1P1FHMK8FlzfRcvASVdNavGmzl0JVJrk2XIjH8gAHqpwR9Chuz
++vAbpv76oQyFHmmHkkEjy4dPZu0LmlfjmGylbEtGNAtwfiWXrXKuHktuGwGsl/f3
+EaKRZ5JtI1f3AoIBAQDaPOWOpbIkEb6OoLP1FdCs0tph26iwnVUT6aaqXUFe3B0T
+E5T0JUv+JcbEUNYvIEB5VmoCJp7EweMAYh81gY4gHUahNWZOwBPZC8tOgk9m39nq
+uD1pFGPJrgtU6KCbTYZquBu8cYcmubd5j2ZiDZxzrPLK9wW39w+axQvqg4vmsm5f
+Fb9Xb766bJ0M//1Ddk1wKDvtELefQrzmSjY61EgXikxbPHNpZAQGSyIrUW7aASyu
+cVWgyKhc4Wu4//id9v0Q+pqg/dJP8tqZT1Gv0ErV7XjSqMXkWBpdHrH0tLydkbJL
+rGcpx7Sgxb/9jhq4ou7XW9iST0x5XN+pY5nvAqS/AoIBAQCdK00X/InPW+nYfND6
+W+E4VWZ8KILL8soPdjs9kQYygCSSt/FAGeqbc7SM7jcZNpPXMDj3R3cSRNtHY+/q
+oMyQAUSJishxtY/3MOUkTOt2Oq0RYoAS1JKnnnhi/+e8c5LhiW8Ny8sjdh0vcN51
+FKJEDbnVnq5J/HOtWBzzrTbahhUTIzdSyGW6udS/3/yfwRRZp+YFMFMqdmIPx95B
+MYp8gzXSZQHS9XX4omdszm3lYq9cKqHFmmdonTkQ+Z978sNdVSLB9Bad5ppqlq26
+SG8nEHoBH7H3Lwd04HAnroXdpR9nARNe92+Okxp1F56inqXUujMfYsm8OBw/tc6b
+a8ZpAoIBAQCjfc4QPsYjY6mGdA0or+FQ1HLk7St1ZV2aHrh3NFcBy8anXLXIDdi/
+xas9QUJ3mgxCS93Z+5JbeKdpCSgDIg+gjRgByOtXtVOgSJiTAP6CpzSUq9VZfmd8
+fySkUWScMYkiel7Bphx/yf+JxuGXUii0TvY4OvL/m0Hd596AOSYxj1SYZqgsXEX9
+IjKV/9mALyClZUmTIMayuTGdMV5+j5d1IX7XqbBkRAn4ZE+QiYimgE09FGnTKESv
+/AFyklbhGI1EOWRyFHigJfZGcidGG0TPOAYYWDRuEjss2bU1e/sEOy3FQ+ob6XAS
+zrjGjQtLCFdeFCWcBG+WmtY0ZKRtXDBc
+-----END PRIVATE KEY-----

test/jest/acceptance/https.spec.ts

@@ -0,0 +1,66 @@
+import * as fs from 'fs';
+import { fakeServer, FakeServer } from '../../acceptance/fake-server';
+import { createProjectFromWorkspace } from '../util/createProject';
+import { getFixturePath } from '../util/getFixturePath';
+import { runSnykCLI } from '../util/runSnykCLI';
+
+jest.setTimeout(1000 * 30);
+
+describe('https', () => {
+  let server: FakeServer;
+  let env: Record<string, string>;
+
+  beforeAll(async () => {
+    const port = process.env.PORT || process.env.SNYK_PORT || '12345';
+    const baseApi = '/api/v1';
+    env = {
+      ...process.env,
+      SNYK_API: 'https://localhost:' + port + baseApi,
+      SNYK_HOST: 'https://localhost:' + port,
+      SNYK_TOKEN: '123456789',
+    };
+    server = fakeServer(baseApi, env.SNYK_TOKEN);
+    await server.listenWithHttps(port, {
+      /**
+       * key and cert were generating using the command below:
+       * faketime 'last week' openssl req -new -newkey rsa:4096 -days 1 -nodes -x509 -subj '/C=US/ST=Denial/L=Springfield/O=Dis/CN=localhost' -keyout localhost-expired.key -out localhost-expired.cert
+       */
+      key: fs.readFileSync(getFixturePath('fake-server/localhost-expired.key')),
+      cert: fs.readFileSync(
+        getFixturePath('fake-server/localhost-expired.cert'),
+      ),
+    });
+  });
+
+  afterEach(() => {
+    server.restore();
+  });
+
+  afterAll((done) => {
+    server.close(() => {
+      done();
+    });
+  });
+
+  describe('expired certificate', () => {
+    it('rejects connections', async () => {
+      const project = await createProjectFromWorkspace('npm-package');
+      const { code, stdout } = await runSnykCLI('test', {
+        cwd: project.path(),
+        env,
+      });
+
+      expect(stdout).toContain('certificate has expired');
+      expect(code).toBe(2);
+    });
+
+    it('accepts connections using --insecure', async () => {
+      const project = await createProjectFromWorkspace('npm-package');
+      const { code } = await runSnykCLI('test --insecure', {
+        cwd: project.path(),
+        env,
+      });
+      expect(code).toBe(0);
+    });
+  });
+});