mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
Groene AI
9cf2d14391
A SAN wildcard pattern configured without a recognized "DNS:"/"URI:" prefix
(for example a bare SAN '*') was routed to the DNS '.' separator by the
is_uri allow-list, because '.' was the default for everything that was not
URI-prefixed. As a result such a pattern matched a "URI:" certificate whose
matched span contains no '.', e.g. URI:spiffe://foo/bar, even though the
original slash-count guard rejected it (0 vs 3 slashes). That widened
URI SAN matching in this security-sensitive path.
Choose the '.' (DNS label) separator via an allow-list of exactly CN and
"DNS:" SANs, and keep every other SAN on the '/' separator. For the '/'
case, "no '/' in the matched span" is identical to the original
count('/', pattern) == count('/', candidate) guard, so URI and
unrecognized-prefix matching is provably unchanged. The non-empty-label
requirement remains scoped to the DNS label case.
Adds an integration regression case: a bare SAN '*' user must not match the
URI certificate URI:spiffe://foo/bar (client11).
28 lines
1.6 KiB
Plaintext
28 lines
1.6 KiB
Plaintext
-----BEGIN CERTIFICATE REQUEST-----
|
|
MIIEnTCCAoUCAQAwWDELMAkGA1UEBhMCUlUxEzARBgNVBAgMClNvbWUtU3RhdGUx
|
|
ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDERMA8GA1UEAwwIY2xp
|
|
ZW50MTEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCzhdzFT5I60PTQ
|
|
Xk75gkhHYH6LL21wPTWF/6id8iRk3p93w7DoMi3iMYqo1GHoD/ub5glGIKA1niR3
|
|
OPlJzYj4QAznWOxSzuQbcu0P14aD2FFqgWV3EjO2rHwmkTdHtfYzggeTitiDaSAB
|
|
WWeQFlwIZIngbv4696WkkSiUlV9vd4L0qqK4CCry6C374M+BHF5MeqNHjGBrcnlo
|
|
KPxJT+pEoq58FDlSH0Hdxp1o2a70Ly2pqVpy1JaflerPDtofTkGNWDCUqEVvGQgV
|
|
Yr3qbWKPzlOF3VNoIlNZkqF5C6kdgkzu23kf7Xyam+YkDFA5LVIVUfnNWxFiSxVH
|
|
dJPif4fJ2BGroZqPHdR2J8UFKOltVkbcKfZsIh8iE23fIKhtzgGGOOuquqez7XFj
|
|
AHJuiShLatq27VvGWxGS/vymhjw/ZtgB1uoGublmUjXLXfZBC+zdN7raAqkhnVn5
|
|
rXgljVBzQtzvVdweWpwnV9zAI9WfUwOD39UjPdTr3PJF9QyBqJvtWMrirUXLFz4R
|
|
hCDSUpZy3gscpvpejbHedjLLVwsl5+ctgob9dNF9/CmGnPqiBiP1Ej2r2sOTg+kS
|
|
bJKN6RTj5OayYf6kKTSeSlUi/kMdiWqXkbswZtFC+E2LNC2b4eFA7+ApqvY3jafk
|
|
cfMFOKmiDYN/BV48Dj7DoXOJ4mX1LQIDAQABoAAwDQYJKoZIhvcNAQELBQADggIB
|
|
AEPp7wCoTzvXPQuZ6ohV2fKValBjhlx0iz/Ij3tIklG6aH9vMgC2HPAuPsPPJkRw
|
|
Psly4nI+FznDzwt4e5cjuqILAnC0gj2HgpmHQaIbEM/8gsmpuyFUOKp2Q2eCEaMT
|
|
Y+74lkY75MxIJmzoEH8LEF8SvB7Oo7Usmc44sGplGDI336L+WeWnK+1GToP4+XUt
|
|
yc3IUF+1tTYrLQcTd3EZUzB4M+qowFnbxal4B2tT8mAOBXBL4nL4MVVsHpOrzwIN
|
|
4klzMqVZMCWbMv7Hd8cpneyCrUFd3iUfLelU66qL+RFEdJPKB6vTTRZY4ZE1GYGy
|
|
Yfn+xw+w9QZ9T1XV+CzSyTMS6t7a88bMkYi3J9nz9/pOcn6HaqecEC+ZryPH2/Ym
|
|
JwZmhiYyKJS/IQ+8j1/4aGRPsPoWmrawtvIK9cr2nxgkH4wmWg4uHikhxUex/YJu
|
|
WsohppENjZ9zZfZvLW12GoKp8LCTcqtyNiuO+VTcCbjJMR9OHj+/BtbSmx7aE0vX
|
|
8Jx2qb1aO+E7gJuQEa5KtJJEmozuGj33L19nlCYpaOVXXeRs2aK/JlF8ym9q5Z5S
|
|
S4lc3V6EVy6S4aIPl//rwby+A1pXBYWp7zWqo2rLbMDkDgfoxIgGd/ssDblbvUsQ
|
|
XAE3SA7yuMNQe1sGFskzQPDOwxY0TEoDUqJG2pb3+5xI
|
|
-----END CERTIFICATE REQUEST-----
|