Blizzard / Blizzard/node-rdkafka
Test certificates are shipped in npm package
- Dominant language
- JavaScript
- Stars
- 2.2k
- Forks
- 403
- PR merge metrics
- No merged PRs in 30d
Description
**Environment Information**
- OS [e.g. Mac, Arch, Windows 10]: Mac
- Node Version [e.g. 8.2.1]:v18.12.0
- NPM Version [e.g. 5.4.2]: 8.19.2
- C++ Toolchain [e.g. Visual Studio, llvm, g++]:
- node-rdkafka version [e.g. 2.3.3]: v2.16.1
**Steps to Reproduce**
The following certificates from the librdkafka dependency are flagged as sensitive data during the security scan:
https://github.com/confluentinc/librdkafka/blob/master/tests/fixtures/ssl/client2.certificate.pem
https://github.com/confluentinc/librdkafka/blob/master/tests/fixtures/ssl/client2.key
Were they included intentionally?
**node-rdkafka Configuration Settings**
**Additional context**
Contributor guide
Research direction
Start by inspecting the published npm package contents and the packaging or build configuration that brings in librdkafka. Check whether tests/fixtures/ssl/client2.certificate.pem and tests/fixtures/ssl/client2.key are included, then verify that the package no longer ships them while the required build and test behavior remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kafka, nodejs
- Domain
- release, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100