mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
Groene AIandClaude Opus 4.8
5746056d31
The single-component wildcard check accepted an empty matched span: for a
user subject DNS:*.corp.example.com and a (malformed) certificate SAN
DNS:.corp.example.com the matched span is empty and contains no separator,
so the wildcard user was authenticated even though no label was matched.
extractAllSubjects stores any non-empty dNSName, so such a name is not
rejected before authentication.
Require the matched span to be non-empty for the DNS/CN ('.'-separator)
case. RFC 6125 6.4.3 requires '*' to match exactly one non-empty label.
URI SAN path segments ('/'-separator) may legitimately be empty, so the
URI case keeps its prior behavior (the matched-span-has-no-'/' rule remains
equivalent to the original count('/') guard).
Add empty-label negative cases (cert client10, CN and DNS SAN
.corp.example.com) to both the DNS and CN wildcard integration tests.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
34 lines
2.0 KiB
Plaintext
34 lines
2.0 KiB
Plaintext
-----BEGIN CERTIFICATE-----
|
|
MIIFoTCCA4mgAwIBAgIUBfEMZ1Z/4weV13ryVA9qyNTPJHUwDQYJKoZIhvcNAQEL
|
|
BQAwUjELMAkGA1UEBhMCUlUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
|
|
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDELMAkGA1UEAwwCY2EwHhcNMjYwNjI1
|
|
MTM1NDE0WhcNMzYwNjIyMTM1NDE0WjBhMQswCQYDVQQGEwJSVTETMBEGA1UECAwK
|
|
U29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRow
|
|
GAYDVQQDDBEuY29ycC5leGFtcGxlLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIP
|
|
ADCCAgoCggIBAPd0NAs6RPlzUu5qwzcbEQCMz/eXlUSRD4wHEU6HN1QrjXIXcpgV
|
|
pO7gq/5/jfD0Lo+QEvi3AjElmlVpmN9ExbU+wUl1cOscPE4uBToylE4qBHQWHToY
|
|
bTmQ3xoIqKo6M6XQfoDiIFAKKSXRf3IP88uZs02Y+g2Qz5XfQcy6xKAe4La+W9/z
|
|
uXs778vi3l3r/P5FGSiKwIN1C4XoxMxVtg9T96l6LC8tRoIaqtYvrnCzTXRZiJ6k
|
|
Kp8Sjq9ySMOgYIrh8yYOqczJyBt7hYKwFZrhNX2OcRIpatLzOG81rwCpWjCykTp6
|
|
zcDcnPljT4p1pfR6+qYSciSJDYNiOl9PzQgsRZ4JaZZ9i8ZK/jIgJiJLXgkRS+uK
|
|
AO0KcvbdCfJpgYy6QximI32Yz3ymBDx7udGgZTIuUJ3ctxH/Xsl6nuf2is+tpU7k
|
|
UFH2K49CGWMNrF+vthPAECJkE0FuRyVTjFuja1znIoPrRvjcSQLiDd+C3XoRHwUQ
|
|
uKfspE5d7iDjB/VQfZpSfZ54pe1XYESSRVk8D+pABCklo4+W+E7MsOoPjZ0SYafk
|
|
ZoHOWfHhmRnFtKBJpu3+TiO0V5kx6c832AEdY9sLwm09YDnwT1Z26iPfYoOiU6Q8
|
|
0KoUYgR7DAPYeSzRFTV1czXILMxFr5GRet+ImwwHEYcCDuEKhbaMVMmBAgMBAAGj
|
|
YDBeMBwGA1UdEQQVMBOCES5jb3JwLmV4YW1wbGUuY29tMB0GA1UdDgQWBBQv/A3e
|
|
+fvcWLmyQu7OrM2fQg1g4TAfBgNVHSMEGDAWgBSJKj1dSYN0jW+Mu0xFQrobZFmQ
|
|
pTANBgkqhkiG9w0BAQsFAAOCAgEAk2j8T4U/u6n5MHpX7FKS7Xh1zCVMLtSWGFPZ
|
|
z03qLiq3t1VWHJNM9cxMJz69W1Ko0RSmYUPCdAdZLijh9Md3M6bQLsBYmBJLdwpY
|
|
tQbDqfFlo8BgDCbuCewA+DMVQMQA6MbwYFPRWnNz9uhXjozB1k304TkuG3LKmTlh
|
|
swQPwRmx7yvhW4InBlrYjwE41mEmuzEVH2vFijRg92gxE8SSh/inOwGAjoKtXD+0
|
|
eSXeBeEFm+wgFq1qwJTkzb3sFvdKxAbdAa5uomQp8cBjMuzoJI/Wtyl2CrfcVG7N
|
|
tkjqXWP8Yv9D2X8XN7peRavey45/aoXHZ64nCY6nuakX2bazP6wv402NTwDoQK2v
|
|
iT89dA6zEAVDkxnlKBDg9VS/ChwTTGmYh0N1zA1C1kS6zLMk+q9gxfQhk8A4xmWH
|
|
9hdI5GpZdKE5ScvhM2MjuHcmp9XQHN5x/0Y7ZHaeODjXErIdKk6j317dcZJgaIVB
|
|
rumL5h1I+rF9EVLpe6zhE+VBUacT/UVdXgj4P9UlsjdmWvUJqkVmcwwejwRZWhrw
|
|
Xic1q8tijkqNYINN97YoTfIg6Ox5zM5O17oI25UnIU3q7LXHRFaPLzX1ZLM5gLeD
|
|
RJWQIeskjTvnl86jS8IpNCDPeco9s3Qq4eIcz0UH9TG/cNhoTRZKLfBQZcBAxRvU
|
|
eRExSQA=
|
|
-----END CERTIFICATE-----
|