fix: Improve heuristic for --openssl-legacy-provider (#19320) (#19522)

Co-authored-by: Emily Rohrbough <[email protected]>

packages/server/lib/plugins/index.js

@@ -53,15 +53,17 @@ const getChildOptions = (config) => {
   }
 
   // https://github.com/cypress-io/cypress/issues/18914
-  // If we're on node version 17 or higher, we need the
-  // NODE_ENV --openssl-legacy-provider so that webpack can continue to use
-  // the md4 hash function. This would cause an error prior to node 17
-  // though, so we have to detect node's major version before spawning the
-  // plugins process.
+  // Node 17+ ships with OpenSSL 3 by default, so we may need the option
+  // --openssl-legacy-provider so that webpack@4 can use the legacy MD4 hash
+  // function. This option doesn't exist on Node <17 or when it is built
+  // against OpenSSL 1, so we have to detect Node's major version and check
+  // which version of OpenSSL it was built against before spawning the plugins
+  // process.
 
   // To be removed on update to webpack >= 5.61, which no longer relies on
-  // node's builtin crypto.hash function.
-  if (semver.satisfies(config.resolvedNodeVersion, '>=17.0.0')) {
+  // Node's builtin crypto.hash function.
+  if (semver.satisfies(config.resolvedNodeVersion, '>=17.0.0') &&
+      !process.versions.openssl.startsWith('1.')) {
     childOptions.env.NODE_OPTIONS += ' --openssl-legacy-provider'
   }
 

packages/server/test/unit/plugins/index_spec.js

@@ -66,16 +66,37 @@ describe('lib/plugins/index', () => {
     })
 
     // https://github.com/cypress-io/cypress/issues/18914
-    it('includes --openssl-legacy-provider in node 17+', () => {
+    it('includes --openssl-legacy-provider in Node 17+ w/ OpenSSL 3', () => {
+      const sandbox = sinon.createSandbox()
+
+      sandbox.stub(process.versions, 'openssl').value('3.0.0-quic')
+
       const childOptions = plugins.getChildOptions({
         resolvedNodeVersion: 'v17.1.0',
       })
 
       expect(childOptions.env.NODE_OPTIONS).to.contain('--openssl-legacy-provider')
+
+      sandbox.restore()
+    })
+
+    // https://github.com/cypress-io/cypress/issues/19320
+    it('does not include --openssl-legacy-provider in Node 17+ w/ OpenSSL 1', () => {
+      const sandbox = sinon.createSandbox()
+
+      sandbox.stub(process.versions, 'openssl').value('1.1.1m')
+
+      const childOptions = plugins.getChildOptions({
+        resolvedNodeVersion: 'v17.3.0',
+      })
+
+      expect(childOptions.env.NODE_OPTIONS).not.to.contain('--openssl-legacy-provider')
+
+      sandbox.restore()
     })
 
     // https://github.com/cypress-io/cypress/issues/18914
-    it('does not include --openssl-legacy-provider in node <=16', () => {
+    it('does not include --openssl-legacy-provider in Node <=16', () => {
       const childOptions = plugins.getChildOptions({
         resolvedNodeVersion: 'v16.31.0',
       })