search

gildas-lormeau / single-file-cli

CLI tool for saving a faithful copy of a complete web page in a single HTML file (based on SingleFile)
GNU Affero General Public License v3.0
602 stars 63 forks source link

where to set ignoreHTTPSErrors config #20

Closed 404name closed 1 year ago

404name commented 1 year ago

Options should not be hardcoded, especially when they have an impact on security. So, the value should come from options and MUST NOT be set to true by default

_Originally posted by @gildas-lormeau in https://github.com/gildas-lormeau/single-file-cli/pull/5#discussion_r920616749_

When I download a website with an expired SSL certificate, it is effective to manually modify the code as above.。

I don't seem to see the entry for setting 'ignoreHTTPSErrors' in the current version. Is it necessary to add a set entry like this?

  if (options.ignoreHTTPSErrors !== undefined) {
    browserOptions.ignoreHTTPSErrors = options.ignoreHTTPSErrors;
  }
gildas-lormeau commented 1 year ago

Where did you read that ignoreHTTPSErrors could be a valid option?

404name commented 1 year ago

Where did you read that ignoreHTTPSErrors could be a valid option?

single-file-cli doesn't work when I download a website with an expired SSL certificate. I directly modify the source code so that will take effect just like #5 add browserOptions.ignoreHTTPSErrors=true . But you close it as you say Options should not be hardcoded, especially when they have an impact on security. So, the value should come from options and MUST NOT be set to true by default

- const browserOptions = {};
+ const browserOptions = {
+   ignoreHTTPSErrors: true
+ }

So now if I don't modify the code, I can't download the website with expired ssl. I can't find the entry of single-file-cli to ignore the SSL certificate error, so I raise an issue to ask if it is ignored, or there is a place to set it just I did not see it.

gildas-lormeau commented 1 year ago

Thank you for the additional info, I just pushed the support of the new option --browser-ignore-insecure-certs. It should work fine with all back-ends used by the CLI.