mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
A SAN wildcard pattern configured without a recognized "DNS:"/"URI:" prefix
(for example a bare SAN '*') was routed to the DNS '.' separator by the
is_uri allow-list, because '.' was the default for everything that was not
URI-prefixed. As a result such a pattern matched a "URI:" certificate whose
matched span contains no '.', e.g. URI:spiffe://foo/bar, even though the
original slash-count guard rejected it (0 vs 3 slashes). That widened
URI SAN matching in this security-sensitive path.
Choose the '.' (DNS label) separator via an allow-list of exactly CN and
"DNS:" SANs, and keep every other SAN on the '/' separator. For the '/'
case, "no '/' in the matched span" is identical to the original
count('/', pattern) == count('/', candidate) guard, so URI and
unrecognized-prefix matching is provably unchanged. The non-empty-label
requirement remains scoped to the DNS label case.
Adds an integration regression case: a bare SAN '*' user must not match the
URI certificate URI:spiffe://foo/bar (client11).
53 lines
3.2 KiB
Plaintext
53 lines
3.2 KiB
Plaintext
-----BEGIN PRIVATE KEY-----
|
|
MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCzhdzFT5I60PTQ
|
|
Xk75gkhHYH6LL21wPTWF/6id8iRk3p93w7DoMi3iMYqo1GHoD/ub5glGIKA1niR3
|
|
OPlJzYj4QAznWOxSzuQbcu0P14aD2FFqgWV3EjO2rHwmkTdHtfYzggeTitiDaSAB
|
|
WWeQFlwIZIngbv4696WkkSiUlV9vd4L0qqK4CCry6C374M+BHF5MeqNHjGBrcnlo
|
|
KPxJT+pEoq58FDlSH0Hdxp1o2a70Ly2pqVpy1JaflerPDtofTkGNWDCUqEVvGQgV
|
|
Yr3qbWKPzlOF3VNoIlNZkqF5C6kdgkzu23kf7Xyam+YkDFA5LVIVUfnNWxFiSxVH
|
|
dJPif4fJ2BGroZqPHdR2J8UFKOltVkbcKfZsIh8iE23fIKhtzgGGOOuquqez7XFj
|
|
AHJuiShLatq27VvGWxGS/vymhjw/ZtgB1uoGublmUjXLXfZBC+zdN7raAqkhnVn5
|
|
rXgljVBzQtzvVdweWpwnV9zAI9WfUwOD39UjPdTr3PJF9QyBqJvtWMrirUXLFz4R
|
|
hCDSUpZy3gscpvpejbHedjLLVwsl5+ctgob9dNF9/CmGnPqiBiP1Ej2r2sOTg+kS
|
|
bJKN6RTj5OayYf6kKTSeSlUi/kMdiWqXkbswZtFC+E2LNC2b4eFA7+ApqvY3jafk
|
|
cfMFOKmiDYN/BV48Dj7DoXOJ4mX1LQIDAQABAoICAApOR7l7AyvFtZwlodaAhGo2
|
|
j6UpXJi6JtGxtsoUbcLtpc1wCj6WLNykl+9vu8wg6MKPHt6r/k59rN28Q1FZj4Ci
|
|
2qrIR87MKjuqKhJD/uigOTJKSdsfTCEzPzBOm1QOTdswnoM5kArhNNFnAsM6iV+A
|
|
+ApOjOExOMzc+W2oMpGZVIb7qbozW9XUftlME1V33bD5xFhV5m4cpPwWCD+kKxB0
|
|
H1yno4/DlBopbf1oK7tAXxhzjKn1as0wA8oNsfdknG5DDwzlqRDC6NwjbkAgNe2H
|
|
/HL9nO1oNQ06FfN3OCblxUlcB5TN4x6UDw7oNw3FPIZVTagcj3+rTEYtGtVAmXij
|
|
9+K5JDFwcCrzhP1HQMchJcoWvWXawbWjO3pi8PwxsvGOcV2YW0/kBGRUbYRdL+27
|
|
y3hE+eFjTHA70HAUjjWw7hPUJIY2WmPOYHsly7ZDqlSg5VWG9fjhVYJaxEcGAG6Q
|
|
OnmyicbEDTk5akqW2lEDSs2Xu/xgHKVQ8F7XBPf9Dtxhpr1Mfd217LNO/5PdgbQ4
|
|
hvaifHRSXQkDMbglP/JxCRnq7mokjLoNe25ymDf3O+vF5ZQ0YpFn99EtzaomIEG8
|
|
PMfZVQCCfkOOTtHdD29xxsrr7pAMwBqcrapHX3q34gGJp0oKGP6Kj1jlLXtBa815
|
|
Y2jFmLo15qINiaqC64cJAoIBAQDlKb3PZ2yEbTMlW6cvZ4LeyDQOaFY4jiSaeA5r
|
|
4Nqu6ico41iefd9o79JvUG5tpDvdO+U5e07nLIA0PifIAIWfK7Rz7auaZjtOOqAq
|
|
0C7URTW5YdVan6lD/8D9UAshXHuaJfPyghYW6ccv16bTip7WlujcAGWoZTg23puR
|
|
nF7bxnT+B/f7yPJyiXXK66MQ0ku0GGPZNdnmDIpm9LjFMwHNYdoxx101YENmqGCe
|
|
A9/8uNyl5021gKxITYFHP/UsyZBkuqjTDe38oopUzinXADhpauBi2RrF2WYQ5kl6
|
|
Xgp3vdNGERFF+mwlM3B9tsDDRho9qKxvNGNp8qsYbbgsr8TFAoIBAQDIi+uBeISX
|
|
WtExQ6IaxwGFmjuKc4ZcuiWsdkIKIgwo7mzdyXqqliyLbWq/G3LD8JjRSzAvmvfx
|
|
PpEMU8ZPKkXFlFVDzCOsrh2TXXll4qbvz4IfLFXUjhl1Ei8BzQpCWM4FoHKEENjM
|
|
VKSIEEIC6nkatUAwrxZotnSvVc2Bv3DuJt9SZpV8aznb6Z2zQvkNxo2WxcjZQtax
|
|
3LmVSoka6dYo8Xw1OA87C5j7O1+pa7je+72C4xxVAownKYO7m/xZiMM/OPoWbUK4
|
|
WWTGIDKS8C/Oah+dscqN9NPIpTsoLaIYSGHC/0ZMUK//3HqWMIAScsM3/NV6Ymd+
|
|
BBLxqPx8owVJAoIBAQCrdByANagaOD1hAP7H19Exb2aLNQL1U1wNei+IBPZ4kdX0
|
|
oIwoIJLrRysRf4LvY0Yq0upApII3MbNF4w8Oc12F5kQfzD1synoqoHA/N/0hchqs
|
|
9YaURAp3Rr2UiLObJT+Q6D5pPWzbfdM6d0Vo1jja4pOcLmvgnsJ9QvXv7qeGFSho
|
|
+3tNFV5X1YKc7MnXBw/+0ZS66bB6jv1p5ETtvajmigSe48NX8QrcnrOS5eFKiuEC
|
|
+1jHqFq9ycckkLSV6sSuqH0xUyWws8d9hbYGFzMdpAn3yuleB7Z2hGWLORrp1cth
|
|
i9l5mtAY0TCjzfzQ3P07DpzcorySgy4Bm+2E+YjlAoIBADkJSlaNPzCIvLxFHwJ8
|
|
nNsxjUOILauLqZFOJOQa4Nh3TvEZD1Ea2tpgqR5nIRHHCL9lofO4IFI1WC1oWhtD
|
|
y4ow8LsSgQbokjLKP++RMac8niZdhp+oNmdMX6Akf4l1FksVYdxbqj0ayZyE+zE3
|
|
HHBTIkl2Umo/khoXzhXbq7OfzJ3z3QoAuPjpjVdhcdHQKY66+6+GyebV/tYN18aW
|
|
wLjuTUQZiINjfgPd1AwsPez1LeXez70Bt3if3v5pk7CnK9h8TOw58OLbUcTjfV66
|
|
/u220v0XhqMvAVisXZHEwLglReCel5C21gdv3lF+w737c7glqVVgTUzSvcyLIhwU
|
|
hTkCggEBAM7QpQeNCVIdLuctyFE5HofGoMUgkp/MA9XT/Lg0l/xIH7xpkZ36I7WO
|
|
9T3r2yxGVImqiYhccwojYh2YKgTIWZU5eNTPvwcpvIlf8qjU9GcZY8CVzu2/jWUk
|
|
nBAoDfOVN6fmO4V6WqmjXvXOo253+fWMW2eNykWu/7Tp9mPgsNYYKHH8reLKRN0q
|
|
s/mPAQO2ZcIBv3Bemrc6dxgavOUF9eLYHLwBDvnMolaiIWmOZz3KvNR9BfJSoyez
|
|
oVnyOXOdtLx3IlZhit/4FzbcZrqfK9ZWHLRBunehxjdd+hIMBcxh9pGd3JGv1NxS
|
|
YnzXV11Nfuwdw28qPXzJlG2FlMfpeD4=
|
|
-----END PRIVATE KEY-----
|