mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
Groene AI
9cf2d14391
A SAN wildcard pattern configured without a recognized "DNS:"/"URI:" prefix
(for example a bare SAN '*') was routed to the DNS '.' separator by the
is_uri allow-list, because '.' was the default for everything that was not
URI-prefixed. As a result such a pattern matched a "URI:" certificate whose
matched span contains no '.', e.g. URI:spiffe://foo/bar, even though the
original slash-count guard rejected it (0 vs 3 slashes). That widened
URI SAN matching in this security-sensitive path.
Choose the '.' (DNS label) separator via an allow-list of exactly CN and
"DNS:" SANs, and keep every other SAN on the '/' separator. For the '/'
case, "no '/' in the matched span" is identical to the original
count('/', pattern) == count('/', candidate) guard, so URI and
unrecognized-prefix matching is provably unchanged. The non-empty-label
requirement remains scoped to the DNS label case.
Adds an integration regression case: a bare SAN '*' user must not match the
URI certificate URI:spiffe://foo/bar (client11).
2 lines
36 B
INI
2 lines
36 B
INI
subjectAltName=URI:spiffe://foo/bar
|