Blizzard / Blizzard/node-rdkafka

Test certificates are shipped in npm package

Open
#1,027 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
2.2k
Forks
403
PR merge metrics
No merged PRs in 30d

Description

**Environment Information**
- OS [e.g. Mac, Arch, Windows 10]: Mac
- Node Version [e.g. 8.2.1]:v18.12.0
- NPM Version [e.g. 5.4.2]: 8.19.2
- C++ Toolchain [e.g. Visual Studio, llvm, g++]:
- node-rdkafka version [e.g. 2.3.3]: v2.16.1

**Steps to Reproduce**

The following certificates from the librdkafka dependency are flagged as sensitive data during the security scan:

https://github.com/confluentinc/librdkafka/blob/master/tests/fixtures/ssl/client2.certificate.pem
https://github.com/confluentinc/librdkafka/blob/master/tests/fixtures/ssl/client2.key

Were they included intentionally?

**node-rdkafka Configuration Settings**

**Additional context**

Contributor guide

Open the contributing guide

Research direction

Start by inspecting the published npm package contents and the packaging or build configuration that brings in librdkafka. Check whether tests/fixtures/ssl/client2.certificate.pem and tests/fixtures/ssl/client2.key are included, then verify that the package no longer ships them while the required build and test behavior remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
kafka, nodejs
Domain
release, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.