Skip to content

feat(pg-connection-string): warn if non-standard ssl options are used #3473

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

feat(pg-connection-string): warn if non-standard ssl options are used #3473

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions packages/pg-connection-string/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
'use strict'

const { emitWarning } = require('node:process')

//Parse method copied from https://github.com/brianc/node-postgres
//Copyright (c) 2010-2014 Brian Carlson ([email protected])
//MIT License
Expand Down Expand Up @@ -133,6 +135,9 @@ function parse(str, options = {}) {
case 'require':
case 'verify-ca':
case 'verify-full': {
if (config.sslmode !== 'verify-full') {
deprecatedSslModeWarning(config.sslmode)
}
break
}
case 'no-verify': {
Expand Down Expand Up @@ -201,6 +206,20 @@ function parseIntoClientConfig(str) {
return toClientConfig(parse(str))
}

function deprecatedSslModeWarning(sslmode) {
if (!deprecatedSslModeWarning.warned) {
deprecatedSslModeWarning.warned = true
emitWarning(`SECURITY WARNING: The SSL modes 'prefer', 'require', and 'verify-ca' are treated as aliases for 'verify-full'.
In the next major version (v3.0.0), these modes will adopt standard libpq semantics, which have weaker security guarantees.

Comment on lines +213 to +214
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: I think this would probably be considered a breaking change to pg itself so might want to call out we'd be bumping pg semver to 9.x at this point as well?

To prepare for this change:
- If you want the current behavior, explicitly use 'sslmode=verify-full'
- If you want libpq compatibility now, use 'uselibpqcompat=true&sslmode=${sslmode}'

See https://www.postgresql.org/docs/current/libpq-ssl.html for libpq SSL mode definitions.`)
}
}

module.exports = parse

parse.parse = parse
Expand Down