Conversation
|
|
| @@ -0,0 +1,122 @@ | |||
|
|
|||
| process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"; | |||
Check failure
Code scanning / CodeQL
Disabling certificate validation High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 1 day ago
In general, you should not globally disable TLS certificate validation. Instead, either (a) leave the default verification behavior in place, or (b) if you must trust a custom/self‑signed certificate (for an emulator or internal endpoint), explicitly configure a proper CA/certificate for that connection only, rather than changing NODE_TLS_REJECT_UNAUTHORIZED.
The single best fix here, without changing existing functionality beyond restoring secure defaults, is to remove the line that sets process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";. Cosmos DB client connections will then use standard TLS verification rules, and any other libraries in the process will no longer have their certificate checks disabled globally. No other code in this file appears to rely on this environment variable, and we do not need to add any imports or helper methods to achieve the fix. The change is localized to the very top of setup-cosmos-containers.js, removing line 2.
| @@ -1,6 +1,6 @@ | ||
|
|
||
| process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"; | ||
|
|
||
|
|
||
| const { CosmosClient } = require("@azure/cosmos"); | ||
|
|
||
| const endpoint = process.env.COSMOS_ENDPOINT || "http://cosmos-db:8081"; |




add emulation command to azure-storage image
change azure-cosmos image to vnext-preview for ARM support
resolve IEL-9
List of Changes
Motivation and Context
How Has This Been Tested?
Screenshots (if appropriate):
Checklist: