awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4282 from JuliusMieliauskas/fix-san-extension-contents

Browse Source 
FIX: x509 SAN Extension to accept IPs and URLs as args
This commit is contained in:
x032205
2025-08-01 15:24:22 -04:00
committed by GitHub
parent a45bba8537 de2c1c5560
commit 4150f81d83
2 changed files with 34 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
backend/src/services/certificate-authority/certificate-authority-validators.ts
View File

@@ -15,10 +15,15 @@ export const validateAltNameField = z
.trim()
.refine(
(name) => {
return isFQDN(name, { allow_wildcard: true }) || z.string().email().safeParse(name).success || isValidIp(name);
return (
isFQDN(name, { allow_wildcard: true, require_tld: false }) ||
z.string().url().safeParse(name).success ||
z.string().email().safeParse(name).success ||
isValidIp(name)
);
},
{
message: "SAN must be a valid hostname, email address, or IP address"
message: "SAN must be a valid hostname, email address, IP address or URL"
}
);
@@ -39,10 +44,15 @@ export const validateAltNamesField = z
if (data === "") return true;
// Split and validate each alt name
return data.split(", ").every((name) => {
return isFQDN(name, { allow_wildcard: true }) || z.string().email().safeParse(name).success || isValidIp(name);
return (
isFQDN(name, { allow_wildcard: true, require_tld: false }) ||
z.string().url().safeParse(name).success ||
z.string().email().safeParse(name).success ||
isValidIp(name)
);
});
},
{
message: "Each alt name must be a valid hostname or email address"
message: "Each alt name must be a valid hostname, email address, IP address or URL"
}
);

24
backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts
View File

@@ -152,7 +152,7 @@ export const InternalCertificateAuthorityFns = ({
extensions.push(extendedKeyUsagesExtension);
}
let altNamesArray: { type: "email" | "dns"; value: string }[] = [];
let altNamesArray: { type: "email" | "dns" | "ip" | "url"; value: string }[] = [];
if (subscriber.subjectAlternativeNames?.length) {
altNamesArray = subscriber.subjectAlternativeNames.map((altName) => {
@@ -160,10 +160,18 @@ export const InternalCertificateAuthorityFns = ({
return { type: "email", value: altName };
}
if (isFQDN(altName, { allow_wildcard: true })) {
if (isFQDN(altName, { allow_wildcard: true, require_tld: false })) {
return { type: "dns", value: altName };
}
if (z.string().url().safeParse(altName).success) {
return { type: "url", value: altName };
}
if (z.string().ip().safeParse(altName).success) {
return { type: "ip", value: altName };
}
throw new BadRequestError({ message: `Invalid SAN entry: ${altName}` });
});
@@ -418,7 +426,7 @@ export const InternalCertificateAuthorityFns = ({
);
}
let altNamesArray: { type: "email" | "dns"; value: string }[] = [];
let altNamesArray: { type: "email" | "dns" | "ip" | "url"; value: string }[] = [];
if (altNames) {
altNamesArray = altNames.split(",").map((altName) => {
@@ -426,10 +434,18 @@ export const InternalCertificateAuthorityFns = ({
return { type: "email", value: altName };
}
if (isFQDN(altName, { allow_wildcard: true })) {
if (isFQDN(altName, { allow_wildcard: true, require_tld: false })) {
return { type: "dns", value: altName };
}
if (z.string().url().safeParse(altName).success) {
return { type: "url", value: altName };
}
if (z.string().ip().safeParse(altName).success) {
return { type: "ip", value: altName };
}
throw new BadRequestError({ message: `Invalid SAN entry: ${altName}` });
});