mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
Groene AI
27c393ef80
A DNS label or CN never contains a slash, but the single-label rule only
forbade '.' in the matched wildcard span. Since extractAllSubjects stores
raw non-empty dNSName/CN strings without validation, a configured subject
'DNS:*.corp.example.com' matched a certificate SAN 'DNS:foo/bar.corp.example.com'
(matched span 'foo/bar' has no '.'), and a slash-containing CN wildcard matched
a deeper name. The original slash-count guard rejected these; the single-label
rewrite had dropped that guard for the DNS/CN branch.
For a DNS label (a CN or a 'DNS:' SAN), the matched span must now be a single
non-empty component containing neither '.' nor '/'. Other SANs ('URI:' or
configured without a recognized prefix) keep the original rule (only '/'
forbidden), which is identical to the slash-count guard, so URI matching is
unchanged.
Adds regression certificate client12 (CN and DNS SAN both
'foo/bar.corp.example.com') and negative cases to the DNS and CN wildcard
single-label tests.