mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
The single-component wildcard check accepted an empty matched span: for a
user subject DNS:*.corp.example.com and a (malformed) certificate SAN
DNS:.corp.example.com the matched span is empty and contains no separator,
so the wildcard user was authenticated even though no label was matched.
extractAllSubjects stores any non-empty dNSName, so such a name is not
rejected before authentication.
Require the matched span to be non-empty for the DNS/CN ('.'-separator)
case. RFC 6125 6.4.3 requires '*' to match exactly one non-empty label.
URI SAN path segments ('/'-separator) may legitimately be empty, so the
URI case keeps its prior behavior (the matched-span-has-no-'/' rule remains
equivalent to the original count('/') guard).
Add empty-label negative cases (cert client10, CN and DNS SAN
.corp.example.com) to both the DNS and CN wildcard integration tests.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
53 lines
3.2 KiB
Plaintext
53 lines
3.2 KiB
Plaintext
-----BEGIN PRIVATE KEY-----
|
|
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQD3dDQLOkT5c1Lu
|
|
asM3GxEAjM/3l5VEkQ+MBxFOhzdUK41yF3KYFaTu4Kv+f43w9C6PkBL4twIxJZpV
|
|
aZjfRMW1PsFJdXDrHDxOLgU6MpROKgR0Fh06GG05kN8aCKiqOjOl0H6A4iBQCikl
|
|
0X9yD/PLmbNNmPoNkM+V30HMusSgHuC2vlvf87l7O+/L4t5d6/z+RRkoisCDdQuF
|
|
6MTMVbYPU/epeiwvLUaCGqrWL65ws010WYiepCqfEo6vckjDoGCK4fMmDqnMycgb
|
|
e4WCsBWa4TV9jnESKWrS8zhvNa8AqVowspE6es3A3Jz5Y0+KdaX0evqmEnIkiQ2D
|
|
YjpfT80ILEWeCWmWfYvGSv4yICYiS14JEUvrigDtCnL23QnyaYGMukMYpiN9mM98
|
|
pgQ8e7nRoGUyLlCd3LcR/17Jep7n9orPraVO5FBR9iuPQhljDaxfr7YTwBAiZBNB
|
|
bkclU4xbo2tc5yKD60b43EkC4g3fgt16ER8FELin7KROXe4g4wf1UH2aUn2eeKXt
|
|
V2BEkkVZPA/qQAQpJaOPlvhOzLDqD42dEmGn5GaBzlnx4ZkZxbSgSabt/k4jtFeZ
|
|
MenPN9gBHWPbC8JtPWA58E9Wduoj32KDolOkPNCqFGIEewwD2Hks0RU1dXM1yCzM
|
|
Ra+RkXrfiJsMBxGHAg7hCoW2jFTJgQIDAQABAoICAADUgvHvHSupzxCkZavL4hgd
|
|
O3ue9onf83RBSBCPkDBEE43LMw0xmeT7Vpe0XiGtklwqOWERl+7vUOEqA8tLHeoX
|
|
rWfxiO+1+kRldRWoKqfoOM16T0OVEO/nRYipovthYHqFJyPSgQr0XMWEZQE+bn9r
|
|
laQW5WRZzMjPEoeVJbtB3UK/A4bY3fGnk+HBsiRQz3Tbfsa3D/Ik80U3dfUM8Xmu
|
|
eujGniremSi5szfj7y8Fj/baD8pJ86gRf1kVSOCUoLbzOaNyRkWCSghAZzmm8pyb
|
|
Vlh0a6VPePefZ/b0taCFa5YOcaGncgTMYf+tbUxyFyIJbqleK5k7Jzh5DMgfR+Pw
|
|
4JIWdGmaW1QgC2hn6uEPiUZLVwpTT2lRR9eUUCOE87Ht1CFpZ5EXciRxuZlplI7Y
|
|
d9u5XJjK6WxYo8BlI6ZZ1jdUX0qkebYtae5yBNDxJ79qJDVQb+3ecZSyZXr1RCpo
|
|
7KylvPYIAbXqgQ9OBv84Db7XapuBATQlm774ruyyWsAnzsnq/IZjUpozXg5nnsJl
|
|
wHc5F1QD/4njslwr5uePq+Vo47La+cdWBmS1n36lJntnPI4kTNVBMhW4wWEPtcAk
|
|
UeU+6FYF4qE2PFAZM62oviX+IaFx6veU60baMdxOzmQAqSsvv2ZQTb71YLerCiem
|
|
9B99YKaxZpBIAfaHFQTRAoIBAQD+9xZqTykDoVec4/ZVQQkMKzOOHVPkvfSR/RjA
|
|
x+DgG8lqKncCZMVgCvIwhaqB5Ao2WTvjtmcPbtLzay3IYUfgHEKu1Hor7z/azxkW
|
|
PYpDeeKTDXOrraSldb+ZzNcu4HM2V88dGTJd/bWSuQXMD8W8FyBXMsxc8s0vPN62
|
|
Zl0y6Rze6U35syXoxGJXMS59SuKz+D4+FbSwVcK6CZmBycv06DAbvX7qfZnwjOVN
|
|
syluZ5qkXRKBM5Cf6ZE05WpIT4RjLoCMicJlDyQtb2JlraMOJljVOcSwgoTkTtzS
|
|
v+edPQhs82zzKyjI76g0SjsG52Jp754uhAiqXiTG7KSkyiOxAoIBAQD4dU+5fwiD
|
|
oEVYgRlIMqFEDEpgtYs6u8yOsH5gHzwBOjx7FfMuHcTYgSIVYUzMxeEAMBPTHpU0
|
|
tjNgvhPnK0Xo/Yfe+AP68dAlwz0ykJ5JjUFlMbBhuoIpghnopgr/693XZnuTbOz3
|
|
FkOxORMVfuS2cRUnK3WIhVHyVuuTkLv20pbgsxxPWRyU102QnGrzevbMLPOgD8JD
|
|
aezmu8XxtnlAd2KvVzGgpvjVW9Qb66SIvLf1PoyM1BBj3oRgv2wiO+4aNE6GNara
|
|
qWsdKRFUhcGCcvvsX0jxfidC0lXnK4cv3oI2LlU1ZybKI+wOeViq8vDgWDD7DdYA
|
|
QUxfpb2BT4bRAoIBAAq8zSzc+JU2jkIFN7KPcpoYl6s8gPP5K/uZ9RjpUgceJHVc
|
|
JHbtV4Kb82cnue6Oc/+l8me8nsp/mFK4CM2Piz9c8VH7kMmY4c+NOTk+jjwZPfmD
|
|
b4OjZHOzacZIYiePPErll8tZ7E0ZCjSLpjrZzzIEp1AEy6Z+czWyEo8L8JDcUGLy
|
|
4F3LtaT/4ERbxeFw7es2YSisMVfbxL+g994HaZd+z8fbSyUE9R60UFPdX7lOk6yo
|
|
XsciLM0PQRZBMyCoeKLUqoVAp/cplBR1xGcT0PIfm04fiLEGTiJvT81wV4i/sUMl
|
|
XUlAYA9WSHcrSSEZTYO4m6jJ1rOWE2ZtQOHPwYECggEBALscRbURqQzPh0nWt356
|
|
up4vj1fzgG3z/mI7IoErJJpcDC454pCJVLQj09I8G4VfREpK6rMkpgMzb8/cdcqy
|
|
+Qw02r0dFIpIz5OQzCanaL1Fhsk5uXZv6hRuaSqe2UvQipnsEQZ+kpqmBsaRkACx
|
|
Nnb7BI4iGXp9xK/3q6PO7O89uuhvmtNa7b5dwok0cwr4QKKU+8g/9fGk9QbyxGh7
|
|
HidhgU1BIhu1g1HSvRNly9w6G2Oy/lAUaF99tT3TCxFhBrhvSe+ivQ+9ZPBp/CYm
|
|
MQwXogdp3toXQmP9WTolusJfFLrO+9ai30B9+wkPc6oSGTsqz4BR9CbvBiBGBkg6
|
|
5vECggEAaqf9C9N5KhiCjUOy4EgU+rwGFZJMEIfeqrN7cPOPCwly4V0LvGZQH5pw
|
|
tgUljd+Nfis0maOzn4rAoLXmD5F1+Uhu+tgt4hDwfvUAyCGABs8BfJWj3owDuq+n
|
|
oXZLuQFemjHp7uPwQMtd1PzWiEr+42xKT5QVQrNleGT0LjTDWi/uf2wMrkzJQymW
|
|
4SL+CICzqVi15KE1QZMiTuP9R5znp6LkhUy9dJz3gg8VcOHAht623IF8OUjC3E2z
|
|
UkTU0fKhaJRdvX8EKf0XzTaj4/Bk5xYlEoSUXWsIhOUUrGmntRwSVhi3OoGIm6Aq
|
|
3RJmi2VS/pmfzWbg9l/Iud2H3EiFaw==
|
|
-----END PRIVATE KEY-----
|