mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
Groene AI
b906bc5c09
A '*' in an ssl_certificate user subject was constrained only by an
equal-slash-count check ("'*' must not represent a '/' in URI"). For CN
and "DNS:" SAN subjects there are no slashes, so the check was always
0 == 0 and did nothing. A user identified by '*.corp.example.com' was
therefore matched by any subject ending in '.corp.example.com',
including multi-label names like 'evil.deep.corp.example.com'. An
attacker able to obtain a CA-signed certificate for a deeper subdomain
could authenticate as the wildcard user.
Per RFC 6125 6.4.3 a wildcard must match exactly one component.
Generalize the separator to be type-aware: '.' for CN and "DNS:" SANs
(DNS label separator), '/' for "URI:" SANs (path separator, preserving
the previous behavior exactly). The matched span between the fixed
prefix and suffix must not contain the separator.
The candidate length is checked before computing the matched span so
its length cannot underflow when the prefix and suffix overlap on a
short candidate (e.g. pattern 'a*a', candidate 'a'), which also removes
a pre-existing overlap false positive. For URI SANs, "matched span has
no '/'" is equivalent to the previous equal-slash-count guard, so
existing URI wildcard behavior is unchanged.
Add integration tests covering DNS and CN wildcards (single-label
positive, multi-label bypass rejected) and a URI SAN whose matched
segment contains a dot (non-regression).
34 lines
2.0 KiB
Plaintext
34 lines
2.0 KiB
Plaintext
-----BEGIN CERTIFICATE-----
|
|
MIIFrTCCA5WgAwIBAgIUBfEMZ1Z/4weV13ryVA9qyNTPJHIwDQYJKoZIhvcNAQEL
|
|
BQAwUjELMAkGA1UEBhMCUlUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
|
|
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDELMAkGA1UEAwwCY2EwHhcNMjYwNjI1
|
|
MTIwMzE2WhcNMzYwNjIyMTIwMzE2WjBnMQswCQYDVQQGEwJSVTETMBEGA1UECAwK
|
|
U29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMSAw
|
|
HgYDVQQDDBdzaW5nbGUuY29ycC5leGFtcGxlLmNvbTCCAiIwDQYJKoZIhvcNAQEB
|
|
BQADggIPADCCAgoCggIBAL0zt/rztZWAfisLMfW8lGC4Snun/48066qFIuj5sErX
|
|
l85tyPdaLb2dj2KWQrojb7UiBj3p1JYTBBXwNbJmIV0Mgc3gdOe0OEvkxsrwF9WD
|
|
/eDacDDWJI8GoLtt/gKdt6jMrilE01Y97VR4ND9c9zdh4x98ZZsx6/1onVCkhUr0
|
|
ZlgDgWRzUyTunmOKwV4AGIvIPggcUW8FS0fJynTeH6NPL40ROscRTRbIabtEy7PA
|
|
MHVtRi0ruvaXuZdVV8en+Xz8wA0z4FsEQ/aUdVs8ZTEvkJNrJRfI228MqaJOVpRW
|
|
aL4tYpSXgOK3yST18OdxNVVa4u20FEjlYnP5c6iAJj2d2bbWESBfCVaVtii1uxyM
|
|
rI/0H1gsZqR+w9Lg8lsqBoX0+rPT7rzVSWWZCIbdeGs6NMzu6xKg1XeSEX1TTN+G
|
|
tfC4Z6ElhkxpCa8BmIqtnHWMNcgdy2GcLOHPFhIdKosek0OQKbItUTNZlnQMoYIR
|
|
8uwrVMItygzz+My6K5mGFYCNsg2ukEPdJImxZRfpvFy0SMmyuGW3hnvmB0Pi5www
|
|
4/pfmniFdQU+XNtu8F+2Caz7u2UcFc3zAPVdSyR5jLJifAq43VYQwC3YrwQRZ8i9
|
|
jsD/TKH0m8SrZYOEH87PbnqEH7ib4jTlf/78oESs81FPTHurr35e6C1hHkc+5XKt
|
|
AgMBAAGjZjBkMCIGA1UdEQQbMBmCF3NpbmdsZS5jb3JwLmV4YW1wbGUuY29tMB0G
|
|
A1UdDgQWBBQ0Enm44tkulCOkVG9Vlg1MTFDxujAfBgNVHSMEGDAWgBSJKj1dSYN0
|
|
jW+Mu0xFQrobZFmQpTANBgkqhkiG9w0BAQsFAAOCAgEAXXqOY9Q4b9NCV/34iAL+
|
|
3fk62XD2e7wV9VFNNpTJRIMbuIpm7+w7D1bhpgmVxlHn51QVBf+faMrvhraLl7cv
|
|
QOudGkTBTbaBEwKSIdyNH9QW7NYAaSPktVQYdu9zYHwxDkA89kVl9aNd4PAppuRc
|
|
gj/d7oRFXR7l/inJgOACVkcmGmF0UvBmEto9M7VsiZTjIoWLUpNn0aHamCNOxd+Q
|
|
jZR7Ae/Enb7gZAUjVRoKJh1FhbjJIQUGm7LqpysIIQddMB6zdrfMzMjRZTmBpq2P
|
|
5+3jRusnrqPc84CSpf7qre+/iLpmA8EwD5uvQM12R3FWOO7sTO7cPHhG6v94b8f3
|
|
eli1TOzo7ZMxKsdoTZswspuUs/Bb08yXQsxpUd5LagFLtAMck20TtDyVs9XDq3Ij
|
|
PVv9KaVLBU09gNNmtHz10GmI90e8PzrvFGpGq5lUnAcx0622tkvd/napUvz9SALQ
|
|
/M2xah6ww+5Tt45qU7SVpyFlgfNVAGEPFfBVNmlfmE1FIL6YyFb1F1ww6L0Z7IDP
|
|
V0CSWP6WwORbqrJKnhf2iKcoqJnyXyt+ld0Z/PvkYLLFKeh/lh2UQLCrMv1bBI4z
|
|
+EArhhSMSCJid5iuXBSQ/um/krh9BqQZ6HCqhk8t+KDu4bVSDp+jER10XRo8robP
|
|
ydmRXFTsKg/8NQ2Ev77XbLI=
|
|
-----END CERTIFICATE-----
|