milliways-infosec/AikidoSec-safe-chain
7
0
Fork 0
mirror of https://github.com/AikidoSec/safe-chain.git synced 2026-05-26 12:10:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Ensure that --cert parameters do not get overriden

Browse source
This commit is contained in:
Reinier Criel 2025-10-28 15:02:59 -07:00
parent 70dc89c3e8
commit a17e14c988
3 changed files with 103 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

14
packages/safe-chain/src/packagemanager/pip/runPipCommand.js
View file

@ -7,10 +7,16 @@ export async function runPip(command, args) {
try {
const env = mergeSafeChainProxyEnvironmentVariables(process.env);
// Pass --cert with our CA to pip so it trusts our MITM for known registries.
// pip will append this to its default CA bundle, so it still validates
// non-registry HTTPS (GitHub, custom mirrors) against system CAs.
const finalArgs = [...args, "--cert", getCaCertPath()];
// If the user already provided --cert, respect their choice and do not override.
// Support both "--cert <path>" and "--cert=<path>" forms.
const hasUserCert = args.some((a, i) => {
if (a === "--cert") return true;
return typeof a === "string" && a.startsWith("--cert=");
});
// By default, pass --cert with our CA so pip trusts our MITM for known registries.
// Note: pip treats --cert as the CA bundle to use for TLS (it does not merge with system CAs).
const finalArgs = hasUserCert ? [...args] : [...args, "--cert", getCaCertPath()];
const result = await safeSpawn(command, finalArgs, {
stdio: "inherit",