alibaba / alibaba/funcraft

fun deploy 对证书文件检查不严谨

Open
#1,006 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
931
Forks
128
PR merge metrics
No merged PRs in 30d

Description

目前的实现方式是判断文件名后缀是否为`.pem`,这样是否不太好?如果要检查证书文件是否正确,应该检查其内容,而不是文件名。

https://github.com/alibaba/funcraft/blob/06373915586924140b24abb7842bb52eae73d07e/src/lib/deploy/deploy-support.js#L253

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at src/lib/deploy/deploy-support.js around line 253, where deployment currently checks the certificate filename suffix. Trace how the certificate file is read and identify the existing validation entry point; done means validation is based on certificate contents rather than accepting or rejecting files solely by their .pem extension. No test file is mentioned in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
cloud, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.