Respect http.proxyStrictSSL

editors/code/src/config.ts

@@ -107,6 +107,9 @@ export class Config {
 
         return httpProxy || process.env["https_proxy"] || process.env["HTTPS_PROXY"];
     }
+    get proxyStrictSSL(): boolean {
+        return vscode.workspace.getConfiguration("http").get("proxyStrictSSL") || true;
+    }
 
     get inlayHints() {
         return {

editors/code/src/main.ts

@@ -198,7 +198,7 @@ async function bootstrapExtension(config: Config, state: PersistentState): Promi
     }
 
     const latestNightlyRelease = await downloadWithRetryDialog(state, async () => {
-        return await fetchRelease("nightly", state.githubToken, config.httpProxy);
+        return await fetchRelease("nightly", state.githubToken, config.httpProxy, config.proxyStrictSSL);
     }).catch(async (e) => {
         log.error(e);
         if (isInitialNightlyDownload) {
@@ -231,6 +231,7 @@ async function bootstrapExtension(config: Config, state: PersistentState): Promi
             dest,
             progressTitle: "Downloading rust-analyzer extension",
             httpProxy: config.httpProxy,
+            proxyStrictSSL: config.proxyStrictSSL,
         });
     });
 
@@ -361,7 +362,7 @@ async function getServer(config: Config, state: PersistentState): Promise<string
 
     const releaseTag = config.package.releaseTag;
     const release = await downloadWithRetryDialog(state, async () => {
-        return await fetchRelease(releaseTag, state.githubToken, config.httpProxy);
+        return await fetchRelease(releaseTag, state.githubToken, config.httpProxy, config.proxyStrictSSL);
     });
     const artifact = release.assets.find(artifact => artifact.name === `rust-analyzer-${platform}.gz`);
     assert(!!artifact, `Bad release: ${JSON.stringify(release)}`);
@@ -374,6 +375,7 @@ async function getServer(config: Config, state: PersistentState): Promise<string
             gunzip: true,
             mode: 0o755,
             httpProxy: config.httpProxy,
+            proxyStrictSSL: config.proxyStrictSSL,
         });
     });
 

editors/code/src/net.ts

@@ -9,6 +9,8 @@ import * as zlib from "zlib";
 import * as util from "util";
 import * as path from "path";
 import { log, assert } from "./util";
+import * as url from "url";
+import * as https from "https";
 
 const pipeline = util.promisify(stream.pipeline);
 
@@ -16,10 +18,19 @@ const GITHUB_API_ENDPOINT_URL = "https://api.github.com";
 const OWNER = "rust-analyzer";
 const REPO = "rust-analyzer";
 
+function makeHttpAgent(proxy: string | null | undefined, options?: https.AgentOptions) {
+    if (proxy) {
+        return new HttpsProxyAgent(proxy, { ...options, ...url.parse(proxy) });
+    } else {
+        return new https.Agent(options);
+    }
+}
+
 export async function fetchRelease(
     releaseTag: string,
     githubToken: string | null | undefined,
     httpProxy: string | null | undefined,
+    proxyStrictSSL: boolean,
 ): Promise<GithubRelease> {
 
     const apiEndpointPath = `/repos/${OWNER}/${REPO}/releases/tags/${releaseTag}`;
@@ -36,10 +47,13 @@ export async function fetchRelease(
     const response = await (() => {
         if (httpProxy) {
             log.debug(`Fetching release metadata via proxy: ${httpProxy}`);
-            return fetch(requestUrl, { headers: headers, agent: new HttpsProxyAgent(httpProxy) });
         }
-
+        let options: any = {};
-        return fetch(requestUrl, { headers: headers });
+        if (proxyStrictSSL) {
+            options["rejectUnauthorized"] = false;
+        }
+        const agent = makeHttpAgent(httpProxy, options);
+        return fetch(requestUrl, { headers: headers, agent: agent });
     })();
 
     if (!response.ok) {
@@ -84,6 +98,7 @@ interface DownloadOpts {
     mode?: number;
     gunzip?: boolean;
     httpProxy?: string;
+    proxyStrictSSL: boolean;
 }
 
 export async function download(opts: DownloadOpts) {
@@ -103,7 +118,7 @@ export async function download(opts: DownloadOpts) {
         },
         async (progress, _cancellationToken) => {
             let lastPercentage = 0;
-            await downloadFile(opts.url, tempFilePath, opts.mode, !!opts.gunzip, opts.httpProxy, (readBytes, totalBytes) => {
+            await downloadFile(opts.url, tempFilePath, opts.mode, !!opts.gunzip, opts.httpProxy, opts.proxyStrictSSL, (readBytes, totalBytes) => {
                 const newPercentage = Math.round((readBytes / totalBytes) * 100);
                 if (newPercentage !== lastPercentage) {
                     progress.report({
@@ -168,6 +183,7 @@ async function downloadFile(
     mode: number | undefined,
     gunzip: boolean,
     httpProxy: string | null | undefined,
+    proxyStrictSSL: boolean,
     onProgress: (readBytes: number, totalBytes: number) => void
 ): Promise<void> {
     const urlString = url.toString();
@@ -175,10 +191,13 @@ async function downloadFile(
     const res = await (() => {
         if (httpProxy) {
             log.debug(`Downloading ${urlString} via proxy: ${httpProxy}`);
-            return fetch(urlString, { agent: new HttpsProxyAgent(httpProxy) });
         }
-
+        let options: any = {};
-        return fetch(urlString);
+        if (proxyStrictSSL) {
+            options["rejectUnauthorized"] = false;
+        }
+        const agent = makeHttpAgent(httpProxy, options);
+        return fetch(urlString, { agent: agent });
     })();
 
     if (!res.ok) {