mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
Groene AIandClaude Opus 4.8
5746056d31
The single-component wildcard check accepted an empty matched span: for a
user subject DNS:*.corp.example.com and a (malformed) certificate SAN
DNS:.corp.example.com the matched span is empty and contains no separator,
so the wildcard user was authenticated even though no label was matched.
extractAllSubjects stores any non-empty dNSName, so such a name is not
rejected before authentication.
Require the matched span to be non-empty for the DNS/CN ('.'-separator)
case. RFC 6125 6.4.3 requires '*' to match exactly one non-empty label.
URI SAN path segments ('/'-separator) may legitimately be empty, so the
URI case keeps its prior behavior (the matched-span-has-no-'/' rule remains
equivalent to the original count('/') guard).
Add empty-label negative cases (cert client10, CN and DNS SAN
.corp.example.com) to both the DNS and CN wildcard integration tests.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
28 lines
1.6 KiB
Plaintext
28 lines
1.6 KiB
Plaintext
-----BEGIN CERTIFICATE REQUEST-----
|
|
MIIEpjCCAo4CAQAwYTELMAkGA1UEBhMCUlUxEzARBgNVBAgMClNvbWUtU3RhdGUx
|
|
ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEaMBgGA1UEAwwRLmNv
|
|
cnAuZXhhbXBsZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQD3
|
|
dDQLOkT5c1LuasM3GxEAjM/3l5VEkQ+MBxFOhzdUK41yF3KYFaTu4Kv+f43w9C6P
|
|
kBL4twIxJZpVaZjfRMW1PsFJdXDrHDxOLgU6MpROKgR0Fh06GG05kN8aCKiqOjOl
|
|
0H6A4iBQCikl0X9yD/PLmbNNmPoNkM+V30HMusSgHuC2vlvf87l7O+/L4t5d6/z+
|
|
RRkoisCDdQuF6MTMVbYPU/epeiwvLUaCGqrWL65ws010WYiepCqfEo6vckjDoGCK
|
|
4fMmDqnMycgbe4WCsBWa4TV9jnESKWrS8zhvNa8AqVowspE6es3A3Jz5Y0+KdaX0
|
|
evqmEnIkiQ2DYjpfT80ILEWeCWmWfYvGSv4yICYiS14JEUvrigDtCnL23QnyaYGM
|
|
ukMYpiN9mM98pgQ8e7nRoGUyLlCd3LcR/17Jep7n9orPraVO5FBR9iuPQhljDaxf
|
|
r7YTwBAiZBNBbkclU4xbo2tc5yKD60b43EkC4g3fgt16ER8FELin7KROXe4g4wf1
|
|
UH2aUn2eeKXtV2BEkkVZPA/qQAQpJaOPlvhOzLDqD42dEmGn5GaBzlnx4ZkZxbSg
|
|
Sabt/k4jtFeZMenPN9gBHWPbC8JtPWA58E9Wduoj32KDolOkPNCqFGIEewwD2Hks
|
|
0RU1dXM1yCzMRa+RkXrfiJsMBxGHAg7hCoW2jFTJgQIDAQABoAAwDQYJKoZIhvcN
|
|
AQELBQADggIBAL55P1fHgxRYxdokaF8vMiP0dxbGq2uvVKEJpOmNwkpWHNwNghml
|
|
vCT8IMgrcH/5G+e4i9VMeGf7PVJGQYPM3WWk8XnOoIK2HqdR6lBO7md6BP0LVThn
|
|
QB2Ol1OfmcFv2HKtdT+2ySDStvNpuBTcxYPoLzsyUZg6U1vOSPcpgm/hACqiupl2
|
|
X2E5p5Gq8lW3KEudbrmEXcv5336OV1oiLxrNfKGoAoK8ctdXZ/pLCuI3krBR9DtS
|
|
JudlevUHf50ujwUlOYKDX3BkdjMHSBETi/aTf3r9r8Mk6AXg+OMWpmT40D9lRGqe
|
|
SYdecyvkbhVXfcKaDR4gqQiwqAvxOcGtXOriYrlV2Hpb1wPyyhRDnDZShO5/wolc
|
|
RifXoKfFxhKh7xgTUJmQjSVxLeNULqSXDzvMHmiyHTcQfUK/8Vgsn9U0aHeeyIMB
|
|
7cNoT24fUy9wElvPn8kuCIIbf4wOqUh2IUa69+UvBGYPdvd59BTjg26Mp8NtFaLT
|
|
wtkNTyVR1SLavQXWPhEXma6+y6grr5RmErLE7wrqeDzHstRt+aMLISP9A4Zr36GY
|
|
bqUTd0nMwQc2KNxKFQDNdp6MusIqZMyiza8l09aQg9bYBP6IDrzp15RXv5w2B+BV
|
|
kRtSBuyoaCMq4Od2CYmb+Ka6JSUdwIuCOYBgUtXBrn+1USux17TUqNbG
|
|
-----END CERTIFICATE REQUEST-----
|