mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
Groene AI
9cf2d14391
A SAN wildcard pattern configured without a recognized "DNS:"/"URI:" prefix
(for example a bare SAN '*') was routed to the DNS '.' separator by the
is_uri allow-list, because '.' was the default for everything that was not
URI-prefixed. As a result such a pattern matched a "URI:" certificate whose
matched span contains no '.', e.g. URI:spiffe://foo/bar, even though the
original slash-count guard rejected it (0 vs 3 slashes). That widened
URI SAN matching in this security-sensitive path.
Choose the '.' (DNS label) separator via an allow-list of exactly CN and
"DNS:" SANs, and keep every other SAN on the '/' separator. For the '/'
case, "no '/' in the matched span" is identical to the original
count('/', pattern) == count('/', candidate) guard, so URI and
unrecognized-prefix matching is provably unchanged. The non-empty-label
requirement remains scoped to the DNS label case.
Adds an integration regression case: a bare SAN '*' user must not match the
URI certificate URI:spiffe://foo/bar (client11).
33 lines
2.0 KiB
Plaintext
33 lines
2.0 KiB
Plaintext
-----BEGIN CERTIFICATE-----
|
|
MIIFlzCCA3+gAwIBAgIUBfEMZ1Z/4weV13ryVA9qyNTPJHYwDQYJKoZIhvcNAQEL
|
|
BQAwUjELMAkGA1UEBhMCUlUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
|
|
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDELMAkGA1UEAwwCY2EwHhcNMjYwNjI1
|
|
MTUwMzE5WhcNMzYwNjIyMTUwMzE5WjBYMQswCQYDVQQGEwJSVTETMBEGA1UECAwK
|
|
U29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMREw
|
|
DwYDVQQDDAhjbGllbnQxMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
|
|
ALOF3MVPkjrQ9NBeTvmCSEdgfosvbXA9NYX/qJ3yJGTen3fDsOgyLeIxiqjUYegP
|
|
+5vmCUYgoDWeJHc4+UnNiPhADOdY7FLO5Bty7Q/XhoPYUWqBZXcSM7asfCaRN0e1
|
|
9jOCB5OK2INpIAFZZ5AWXAhkieBu/jr3paSRKJSVX293gvSqorgIKvLoLfvgz4Ec
|
|
Xkx6o0eMYGtyeWgo/ElP6kSirnwUOVIfQd3GnWjZrvQvLampWnLUlp+V6s8O2h9O
|
|
QY1YMJSoRW8ZCBViveptYo/OU4XdU2giU1mSoXkLqR2CTO7beR/tfJqb5iQMUDkt
|
|
UhVR+c1bEWJLFUd0k+J/h8nYEauhmo8d1HYnxQUo6W1WRtwp9mwiHyITbd8gqG3O
|
|
AYY466q6p7PtcWMAcm6JKEtq2rbtW8ZbEZL+/KaGPD9m2AHW6ga5uWZSNctd9kEL
|
|
7N03utoCqSGdWfmteCWNUHNC3O9V3B5anCdX3MAj1Z9TA4Pf1SM91Ovc8kX1DIGo
|
|
m+1YyuKtRcsXPhGEINJSlnLeCxym+l6Nsd52MstXCyXn5y2Chv100X38KYac+qIG
|
|
I/USPavaw5OD6RJsko3pFOPk5rJh/qQpNJ5KVSL+Qx2JapeRuzBm0UL4TYs0LZvh
|
|
4UDv4Cmq9jeNp+Rx8wU4qaINg38FXjwOPsOhc4niZfUtAgMBAAGjXzBdMBsGA1Ud
|
|
EQQUMBKGEHNwaWZmZTovL2Zvby9iYXIwHQYDVR0OBBYEFPKPqaZxodaZTuIiRhIQ
|
|
1AlOr34pMB8GA1UdIwQYMBaAFIkqPV1Jg3SNb4y7TEVCuhtkWZClMA0GCSqGSIb3
|
|
DQEBCwUAA4ICAQCwfBnGs7ap3SdYWzCKNZ7VDa3z2LASX7UIUURDzqFVkd+yqnkq
|
|
o/bA6fsG+kJquq3cKcU1xr8ikeH59A0sE8EnFuCzLz5uwgCNbg50jD73U8BpeUfP
|
|
00y10ru5LNCV/Oq6XQerzl4QAADnmMccbDixpRZCAVIXeiZHA6MLNKfSlNFtNw1l
|
|
yYjLB57xJmPzzt0wS/V7AVhMx8qC3UTtFZII2w8bEBIKMQ+2Vg5bhjUYTMmTc/m7
|
|
3c/dBjKenIY7uNr3KIG54+uKRzSlqcG08+qrmnzJEYXzRfW4pdbLKgfK/hz450Ae
|
|
62Ml7x5KtIeQUsTrXGefPK1LpM8531lvvbcMO3yMjdwvmJjeHOyyZ8eaIoiWjcd0
|
|
RkrCA3BOs8gnCn4XaVS0OmxreV08H4OPKBN5Cu5IKbzVGTGeW6jT38UYpMI/+JUt
|
|
VbSvkD6H3DKU95ohI8OydaAH8C222QhaEaNjdnbmffKSyPtJom+/h6kMR41BiqQo
|
|
bLY0K24q5dJJVbZmnrEhtFMyfUbr25jn3KdQ7le+oO1bcpwFul3gypRbxZ8bg2L7
|
|
sLGBNuCD9fdQrGasNFxOgp1q6v91fWLtJ6mooAXJuMzhnqJmWUtoQFVV+CvDg17D
|
|
eswxL1Ab6apkhi1gw9/N1OVfBFwzpkaLQMvO7gQ5OHCR38DVbxlJe2Jphg==
|
|
-----END CERTIFICATE-----
|