Repository navigation
src: honor NODE_EXTRA_CA_CERTS set in an env file - #66638
Open
marcopiraccini wants to merge 3 commits into
Open
marcopiraccini wants to merge 3 commits into
marcopiraccini wants to merge 3 commits into
Conversation
NODE_EXTRA_CA_CERTS is read once at startup, before the files passed with --env-file are applied to the environment. A value set in an env file showed up in process.env but the certificates were never loaded. Look the variable up in the parsed env files when it is not in the environment. The environment keeps precedence, and the env files are ignored under the same conditions as the environment: when node runs setuid, setgid or with Linux file capabilities. Fixes: nodejs#51426 Refs: nodejs#51497 Signed-off-by: marcopiraccini <marco.piraccini@gmail.com>
Collaborator
|
Review requested:
|
nodejs-github-bot
added
c++
marcopiraccini
marked this pull request as ready for review
October 10, 2026 08:15
ShogunPanda
reviewed
Oct 10, 2026
| added: v7.3.0 | ||
| changes: | ||
| - version: REPLACEME | ||
| pr-url: https://github.com/nodejs/node/pull/00000 |
Contributor
There was a problem hiding this comment.
Nit: replace this. But not blocking.
ShogunPanda
approved these changes
Oct 10, 2026
Signed-off-by: marcopiraccini <marco.piraccini@gmail.com>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #66638 +/- ##
==========================================
- Coverage 92.78% 90.66% -2.12%
==========================================
Files 422 797 +375
Lines 193692 278815 +85123
Branches 29881 53620 +23739
==========================================
+ Hits 179718 252801 +73083
- Misses 13645 16360 +2715
- Partials 329 9654 +9325
🚀 New features to boost your workflow:
|
Contributor
Author
|
Note on coverage: The two partials are the elevated-privilege branch of |
ShogunPanda
added
the
request-ci
ShogunPanda
approved these changes
Oct 26, 2026
github-actions
Bot
removed
the
request-ci
Collaborator
addaleax
reviewed
Oct 30, 2026
| auto match = store_.find(key); | ||
| if (match == store_.end()) return std::nullopt; | ||
| return match->second; | ||
| #endif |
Member
There was a problem hiding this comment.
Instead of an #ifdef here, we should probably adjust the comparison functions for store_ to handle case-insensitivity on Windows
Contributor
Author
There was a problem hiding this comment.
OK, good point. Changed store_ to use a case-insensitive comparator on Windows for the --env-file .
@addaleax note that This is broader than the original NODE_EXTRA_CA_CERTS fix: it also makes NODE_OPTIONS lookup case-insensitive (n win) and makes the last value win for keys that differ only in case.
Give the Dotenv store a comparator and let the instance that holds the --env-file variables ignore case on Windows, where environment variable names are case-insensitive, instead of scanning the store in Dotenv::Get(). NODE_OPTIONS read from an env file follows the same rule. util.parseEnv() and process.loadEnvFile() keep comparing keys case-sensitively on every platform: their keys also end up in case-sensitive stores, such as the environment of a Worker. Refs: nodejs#66638 (comment) Signed-off-by: marcopiraccini <marco.piraccini@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
NODE_EXTRA_CA_CERTSset through--env-fileappeared inprocess.env, but its certificates were not loaded because the startup lookup ran before the env files were applied.Read the value from the parsed env files when it is absent from the process environment. This supports both
--env-fileand--env-file-if-exists, preserves environment precedence, and uses case-insensitive lookup on Windows.Both lookups share the existing
SafeGetenv()privilege check, so the env-file fallback cannot bypass it. Runtime changes, includingprocess.loadEnvFile(), still do not reload certificates; the documentation now states this explicitly.This revisits #51497, where review raised the concern that reading from env files could bypass
SafeGetenv()'s privilege checks. Both lookups now share that check, addressing the concern.Regression tests cover both flags, environment precedence, lowercase variable names on Windows, and a TLS connection that requires the extra CA.
Fixes: #51426
Refs: #51497