fix: apply allowSelfSignedCerts to connector fetch calls

[RobertLD]

The allowSelfSignedCerts config from PR #239 only covered url-fetcher.ts (libscope add <url>). Connectors like Confluence, Slack, and Notion use fetchWithRetry from http-utils.ts which bypassed the TLS override.

Fix: fetchWithRetry now reads loadConfig().indexing.allowSelfSignedCerts and temporarily sets NODE_TLS_REJECT_UNAUTHORIZED=0 during the request (same pattern as url-fetcher).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
libscope	Ignored		Mar 2, 2026 5:10pm

In general, the problem should be fixed by avoiding global disabling of TLS certificate validation (NODE_TLS_REJECT_UNAUTHORIZED = "0"). Instead, certificate handling must be configured per connection, typically by using a custom HTTPS/TLS agent that either (a) trusts a specific CA or certificate bundle, or (b) is used only when you explicitly want to allow self‑signed certificates (and even then, ideally by trusting those specific certs, not disabling validation entirely).

In this code, the safest way to preserve functionality while removing the global override is:

1. Do not touch process.env["NODE_TLS_REJECT_UNAUTHORIZED"] at all.
2. When config.indexing.allowSelfSignedCerts is true, create a Node.js https.Agent with rejectUnauthorized: false and pass it to fetch via the dispatcher option used by Node’s undici/built‑in fetch. This scopes the relaxed validation to this specific call instead of the whole process.
3. When allowSelfSignedCerts is false, call fetch as before with the original options.
4. Preserve all retry logic and behaviour otherwise.

Concretely, in src/connectors/http-utils.ts:

• Add an import for Node’s https module.
• Remove the logic that saves/restores NODE_TLS_REJECT_UNAUTHORIZED and the surrounding finally clean‑up.
• Before calling fetch, if config.indexing.allowSelfSignedCerts is true, construct an https.Agent({ rejectUnauthorized: false }) and set options = { ...options, dispatcher: new Agent({ connect: { tls: { rejectUnauthorized: false }}}) } if you’re using undici, or otherwise use the agent supported by your fetch implementation. Since we must avoid assumptions, the minimal safe change is to stop using NODE_TLS_REJECT_UNAUTHORIZED and leave certificate validation behaviour to the project’s fetch setup; if you know you’re on Node 18+ with undici, you can add the appropriate dispatcher, but I’ll constrain the fix to removing the global env override.

Because we must not assume details of the fetch implementation and cannot change other files, the best minimal fix is to remove the environment variable manipulation entirely. This eliminates the CodeQL‑flagged insecure behaviour. If allowSelfSignedCerts is required for functionality, it should be re‑implemented elsewhere using a scoped agent/CA configuration, but that’s outside this snippet.