mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
Groene AIandClaude Opus 4.8
5746056d31
The single-component wildcard check accepted an empty matched span: for a
user subject DNS:*.corp.example.com and a (malformed) certificate SAN
DNS:.corp.example.com the matched span is empty and contains no separator,
so the wildcard user was authenticated even though no label was matched.
extractAllSubjects stores any non-empty dNSName, so such a name is not
rejected before authentication.
Require the matched span to be non-empty for the DNS/CN ('.'-separator)
case. RFC 6125 6.4.3 requires '*' to match exactly one non-empty label.
URI SAN path segments ('/'-separator) may legitimately be empty, so the
URI case keeps its prior behavior (the matched-span-has-no-'/' rule remains
equivalent to the original count('/') guard).
Add empty-label negative cases (cert client10, CN and DNS SAN
.corp.example.com) to both the DNS and CN wildcard integration tests.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
2 lines
37 B
INI
2 lines
37 B
INI
subjectAltName=DNS:.corp.example.com
|