weiguoqiang/cert-manager
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Fix a memory bug in ldap's ParseDN function by disabling part of the functionality

Browse Source 
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
This commit is contained in:
Tim Ramlot 2024-02-19 12:55:06 +01:00
parent a22d1d673a
commit 4a8b8c4e09
No known key found for this signature in database
GPG Key ID: 47428728E0C2878D
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
pkg/util/pki/parse_test.go
View File

@ -268,3 +268,12 @@ func TestMustKeepOrderInRawDerBytes(t *testing.T) {
assert.Equal(t, expectedRdnSeq, rdnSeq)
assert.Equal(t, subject, rdnSeq.String())
}
func TestShouldFailForHexDER(t *testing.T) {
_, err := ParseSubjectStringToRawDERBytes("DF=#6666666666665006838820013100000746939546349182108463491821809FBFFFFFFFFF")
if err == nil {
t.Fatal("expected error, but got none")
}
assert.Contains(t, err.Error(), "unsupported distinguished name (DN) \"DF=#6666666666665006838820013100000746939546349182108463491821809FBFFFFFFFFF\": notation does not support x509.subject identities containing \"=#\"")
}

6
pkg/util/pki/subject.go
View File

@ -21,6 +21,8 @@ import (
"crypto/x509/pkix"
"encoding/asn1"
"errors"
"fmt"
"strings"
"github.com/go-ldap/ldap/v3"
)
@ -66,6 +68,10 @@ var attributeTypeNames = map[string][]int{
}
func UnmarshalSubjectStringToRDNSequence(subject string) (pkix.RDNSequence, error) {
if strings.Contains(subject, "=#") {
return nil, fmt.Errorf("unsupported distinguished name (DN) %q: notation does not support x509.subject identities containing \"=#\"", subject)
}
dns, err := ldap.ParseDN(subject)
if err != nil {
return nil, err