awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

More test cases

Browse Source 
# Conflicts:
#	backend/src/ee/services/pki-acme/pki-acme-schemas.ts

# Conflicts:
#	backend/src/ee/services/pki-acme/pki-acme-service.ts
This commit is contained in:
Fang-Pen Lin
2025-11-06 19:58:19 -08:00
parent 795d0b36ec
commit 460dea84be
3 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
backend/bdd/features/pki/acme/order.feature
View File

@@ -130,8 +130,9 @@ Feature: Order
Examples: Bad Identifier Vluaes
| identifier_value |
| 127.0.0.1 |
| 192.168.123.111 |
| 127.0.0.1 |
| 192.168.123.111 |
| 169.254.169.254 |
| ../../etc/passwd |
Then the value response.status_code should be equal to 400

2
backend/src/ee/services/pki-acme/pki-acme-schemas.ts
View File

@@ -84,6 +84,8 @@ export const CreateAcmeAccountResponseSchema = z.object({
orders: z.string().optional()
});
export const ValidDNSIdentifierRegex = /^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*$/;
// New Order payload schema
export const CreateAcmeOrderBodySchema = z.object({
identifiers: z.array(

18
backend/src/ee/services/pki-acme/pki-acme-service.ts
View File

@@ -54,7 +54,8 @@ import {
AcmeIdentifierType,
AcmeOrderStatus,
CreateAcmeAccountBodySchema,
ProtectedHeaderSchema
ProtectedHeaderSchema,
ValidDNSIdentifierRegex
} from "./pki-acme-schemas";
import {
TAcmeOrderResource,
@@ -483,6 +484,21 @@ export const pkiAcmeServiceFactory = ({
// TODO: check the identifiers and see if are they even allowed for this profile.
// if not, we may be able to reject it early with an unsupportedIdentifier error.
// TODO: ideally, we should return an error with subproblems if we have multiple unsupported identifiers
if (payload.identifiers.some((identifier) => identifier.type !== AcmeIdentifierType.DNS)) {
throw new AcmeUnsupportedIdentifierError({ message: "Only DNS identifiers are supported" });
}
if (
payload.identifiers.some(
(identifier) =>
!ValidDNSIdentifierRegex.test(identifier.value) ||
isPrivateIp(identifier.value) ||
(!getConfig().isDevelopmentMode && identifier.value.toLowerCase() === "localhost")
)
) {
throw new AcmeUnsupportedIdentifierError({ message: "Invalid DNS identifier" });
}
const order = await acmeOrderDAL.transaction(async (tx) => {
const account = (await acmeAccountDAL.findByProjectIdAndAccountId(profileId, accountId))!;
const createdOrder = await acmeOrderDAL.create(