中间人攻击: NODE_TLS_REJECT_UNAUTHORIZED enables Man-in-the-middle Attacks (MiTM)

[WookieSheep]

The following exists in https://github.com/aliyun/oss-browser/blob/develop/main.js#L6 and has been present for 3 years according to the repository history.

It appears to also be present in downloads provided by alibabacloud.com
https://www.alibabacloud.com/help/en/oss/developer-reference/install-and-log-on-to-ossbrowser

// use self signed certificate for Apsara Stack
// https://stackoverflow.com/questions/58615762/will-an-electron-based-app-pass-system-wide-nodejs-environment-variables
process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = 0;

NODE_TLS_REJECT_UNAUTHORIZED should be removed here as it allows for MitM capabilities for adversaries.

A test was carried out locally to confirm:

Login credentials and data are likely not secure until this is fixed.