[misc] zero config not permitting non plugins without hash

Author: rusher

lib/cmd/handshake/authentication.js

@@ -1,5 +1,5 @@
 //  SPDX-License-Identifier: LGPL-2.1-or-later
-//  Copyright (c) 2015-2024 MariaDB Corporation Ab
+//  Copyright (c) 2015-2025 MariaDB Corporation Ab
 
 'use strict';
 
@@ -81,7 +81,7 @@ class Authentication extends Command {
             if (packet.remaining()) {
               const validationHash = packet.readBufferLengthEncoded();
               if (validationHash.length > 0) {
-                if (!this.plugin.permitHash() || !this.cmdParam.opts.password || this.cmdParam.opts.password === '') {
+                if (!this.plugin.permitHash() || !Boolean(this.cmdParam.opts.password)) {
                   return this.throwNewError(
                     'Self signed certificates. Either set `ssl: { rejectUnauthorized: false }` (trust mode) or provide server certificate to client',
                     true,
@@ -253,6 +253,21 @@ class Authentication extends Command {
       pluginData = packet.readBufferRemaining();
     }
 
+    if (
+      info.requireValidCert &&
+      info.selfSignedCertificate &&
+      Boolean(this.cmdParam.opts.password) &&
+      !this.plugin.permitHash()
+    ) {
+      return this.throwNewError(
+        `Unsupported authentication plugin ${pluginName} with Self signed certificates. Either set 'ssl: { rejectUnauthorized: false }' (trust mode) or provide server certificate to client`,
+        true,
+        info,
+        '08000',
+        Errors.ER_SELF_SIGNED_BAD_PLUGIN
+      );
+    }
+
     if (opts.restrictedAuth && !opts.restrictedAuth.includes(pluginName)) {
       this.throwNewError(
         `Unsupported authentication plugin ${pluginName}. Authorized plugin: ${opts.restrictedAuth.toString()}`,

lib/misc/errors.js

@@ -1,5 +1,5 @@
 //  SPDX-License-Identifier: LGPL-2.1-or-later
-//  Copyright (c) 2015-2024 MariaDB Corporation Ab
+//  Copyright (c) 2015-2025 MariaDB Corporation Ab
 
 'use strict';
 const ErrorCodes = require('../const/error-code');
@@ -152,6 +152,7 @@ module.exports.ER_PRIVATE_FIELDS_USE = 45058;
 module.exports.ER_TLS_IDENTITY_ERROR = 45059;
 module.exports.ER_POOL_NOT_INITIALIZED = 45060;
 module.exports.ER_POOL_NO_CONNECTION = 45061;
+module.exports.ER_SELF_SIGNED_BAD_PLUGIN = 45062;
 
 const keys = Object.keys(module.exports);
 const errByNo = {};