awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 09:30:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix x509 SAN Extension to accept IPs and URLs as args

Browse Source
This commit is contained in:
Julius Mieliauskas
2025-07-31 02:41:38 +03:00
parent c266d68993
commit 1e29d550be
4 changed files with 178 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/certificate-authority/certificate-authority-validators.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { z } from "zod";
import { isValidIp } from "@app/lib/ip";
import { isFQDN } from "@app/lib/validator/validate-url";
import { isFQDN, isURL } from "@app/lib/validator/validate-url";
const isValidDate = (dateString: string) => {
const date = new Date(dateString);
@@ -15,7 +15,7 @@ export const validateAltNameField = z
.trim()
.refine(
(name) => {
return isFQDN(name, { allow_wildcard: true }) || z.string().email().safeParse(name).success || isValidIp(name);
return isFQDN(name, { allow_wildcard: true }) || isURL(name) || z.string().email().safeParse(name).success || isValidIp(name);
},
{
message: "SAN must be a valid hostname, email address, or IP address"
backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts
+20 -3
View File
@@ -9,7 +9,8 @@ import { getConfig } from "@app/lib/config/env";
import { crypto } from "@app/lib/crypto/cryptography";
import { BadRequestError } from "@app/lib/errors";
import { ms } from "@app/lib/ms";
import { isFQDN } from "@app/lib/validator/validate-url";
import { isFQDN, isURL } from "@app/lib/validator/validate-url";
import { isIP } from "net";
import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
@@ -152,7 +153,7 @@ export const InternalCertificateAuthorityFns = ({
extensions.push(extendedKeyUsagesExtension);
}
let altNamesArray: { type: "email" | "dns"; value: string }[] = [];
let altNamesArray: { type: "email" | "dns" | "ip" | "url"; value: string }[] = [];
if (subscriber.subjectAlternativeNames?.length) {
altNamesArray = subscriber.subjectAlternativeNames.map((altName) => {
@@ -160,6 +161,14 @@ export const InternalCertificateAuthorityFns = ({
return { type: "email", value: altName };
}
if(isURL(altName)) {
return { type: "url", value: altName };
}
if (isIP(altName)) {
return { type: "ip", value: altName };
}
if (isFQDN(altName, { allow_wildcard: true })) {
return { type: "dns", value: altName };
}
@@ -418,7 +427,7 @@ export const InternalCertificateAuthorityFns = ({
);
}
let altNamesArray: { type: "email" | "dns"; value: string }[] = [];
let altNamesArray: { type: "email" | "dns" | "ip" | "url"; value: string }[] = [];
if (altNames) {
altNamesArray = altNames.split(",").map((altName) => {
@@ -430,6 +439,14 @@ export const InternalCertificateAuthorityFns = ({
return { type: "dns", value: altName };
}
if(isURL(altName)) {
return { type: "url", value: altName };
}
if (isIP(altName)) {
return { type: "ip", value: altName };
}
throw new BadRequestError({ message: `Invalid SAN entry: ${altName}` });
});