807c7e14f4
The internal use of tls.parseCertString was removed in
a336444c7f. The function does not handle
multi-value RDNs correctly, leading to incorrect representations and
security concerns.
This change is breaking in two ways: tls.parseCertString is removed
(but has been runtime-deprecated since Node.js 9) and
_tls_common.translatePeerCertificate does not translate the `subject`
and `issuer` properties anymore.
This change also removes the recommendation to use querystring.parse
instead, which is similarly dangerous.
PR-URL: https://github.com/nodejs/node/pull/41479
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
70 lines
2.6 KiB
JavaScript
70 lines
2.6 KiB
JavaScript
/* eslint-disable no-proto */
|
|
'use strict';
|
|
const common = require('../common');
|
|
|
|
if (!common.hasCrypto)
|
|
common.skip('missing crypto');
|
|
|
|
const { strictEqual, deepStrictEqual } = require('assert');
|
|
const { translatePeerCertificate } = require('_tls_common');
|
|
|
|
const certString = '__proto__=42\nA=1\nB=2\nC=3';
|
|
|
|
strictEqual(translatePeerCertificate(null), null);
|
|
strictEqual(translatePeerCertificate(undefined), null);
|
|
|
|
strictEqual(translatePeerCertificate(0), null);
|
|
strictEqual(translatePeerCertificate(1), 1);
|
|
|
|
deepStrictEqual(translatePeerCertificate({}), {});
|
|
|
|
// Earlier versions of Node.js parsed the issuer property but did so
|
|
// incorrectly. This behavior has now reached end-of-life and user-supplied
|
|
// strings will not be parsed at all.
|
|
deepStrictEqual(translatePeerCertificate({ issuer: '' }),
|
|
{ issuer: '' });
|
|
deepStrictEqual(translatePeerCertificate({ issuer: null }),
|
|
{ issuer: null });
|
|
deepStrictEqual(translatePeerCertificate({ issuer: certString }),
|
|
{ issuer: certString });
|
|
|
|
// Earlier versions of Node.js parsed the issuer property but did so
|
|
// incorrectly. This behavior has now reached end-of-life and user-supplied
|
|
// strings will not be parsed at all.
|
|
deepStrictEqual(translatePeerCertificate({ subject: '' }),
|
|
{ subject: '' });
|
|
deepStrictEqual(translatePeerCertificate({ subject: null }),
|
|
{ subject: null });
|
|
deepStrictEqual(translatePeerCertificate({ subject: certString }),
|
|
{ subject: certString });
|
|
|
|
deepStrictEqual(translatePeerCertificate({ issuerCertificate: '' }),
|
|
{ issuerCertificate: null });
|
|
deepStrictEqual(translatePeerCertificate({ issuerCertificate: null }),
|
|
{ issuerCertificate: null });
|
|
deepStrictEqual(
|
|
translatePeerCertificate({ issuerCertificate: { subject: certString } }),
|
|
{ issuerCertificate: { subject: certString } });
|
|
|
|
{
|
|
const cert = {};
|
|
cert.issuerCertificate = cert;
|
|
deepStrictEqual(translatePeerCertificate(cert), { issuerCertificate: cert });
|
|
}
|
|
|
|
deepStrictEqual(translatePeerCertificate({ infoAccess: '' }),
|
|
{ infoAccess: Object.create(null) });
|
|
deepStrictEqual(translatePeerCertificate({ infoAccess: null }),
|
|
{ infoAccess: null });
|
|
{
|
|
const input =
|
|
'__proto__:mostly harmless\n' +
|
|
'hasOwnProperty:not a function\n' +
|
|
'OCSP - URI:file:///etc/passwd\n';
|
|
const expected = Object.create(null);
|
|
expected.__proto__ = ['mostly harmless'];
|
|
expected.hasOwnProperty = ['not a function'];
|
|
expected['OCSP - URI'] = ['file:///etc/passwd'];
|
|
deepStrictEqual(translatePeerCertificate({ infoAccess: input }),
|
|
{ infoAccess: expected });
|
|
}
|