awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-05 12:26:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

More test cases

Browse Source 
# Conflicts:
#	backend/src/ee/services/pki-acme/pki-acme-schemas.ts

# Conflicts:
#	backend/src/ee/services/pki-acme/pki-acme-service.ts
This commit is contained in:
Fang-Pen Lin
2025-11-12 09:12:19 -08:00
parent 795d0b36ec
commit 460dea84be
3 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/bdd/features/pki/acme/order.feature
+3 -2
View File
@@ -130,8 +130,9 @@ Feature: Order
Examples: Bad Identifier Vluaes Examples: Bad Identifier Vluaes
| identifier_value | | identifier_value |
| 127.0.0.1 | | 127.0.0.1 |
| 192.168.123.111 | | 192.168.123.111 |
| 169.254.169.254 |
| ../../etc/passwd | | ../../etc/passwd |
Then the value response.status_code should be equal to 400 Then the value response.status_code should be equal to 400
backend/src/ee/services/pki-acme/pki-acme-schemas.ts
+2
View File
@@ -84,6 +84,8 @@ export const CreateAcmeAccountResponseSchema = z.object({
orders: z.string().optional() orders: z.string().optional()
}); });
export const ValidDNSIdentifierRegex = /^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*$/;
// New Order payload schema // New Order payload schema
export const CreateAcmeOrderBodySchema = z.object({ export const CreateAcmeOrderBodySchema = z.object({
identifiers: z.array( identifiers: z.array(
backend/src/ee/services/pki-acme/pki-acme-service.ts
+17 -1
View File
@@ -54,7 +54,8 @@ import {
AcmeIdentifierType, AcmeIdentifierType,
AcmeOrderStatus, AcmeOrderStatus,
CreateAcmeAccountBodySchema, CreateAcmeAccountBodySchema,
ProtectedHeaderSchema ProtectedHeaderSchema,
ValidDNSIdentifierRegex
} from "./pki-acme-schemas"; } from "./pki-acme-schemas";
import { import {
TAcmeOrderResource, TAcmeOrderResource,
@@ -483,6 +484,21 @@ export const pkiAcmeServiceFactory = ({
// TODO: check the identifiers and see if are they even allowed for this profile. // TODO: check the identifiers and see if are they even allowed for this profile.
// if not, we may be able to reject it early with an unsupportedIdentifier error. // if not, we may be able to reject it early with an unsupportedIdentifier error.
// TODO: ideally, we should return an error with subproblems if we have multiple unsupported identifiers
if (payload.identifiers.some((identifier) => identifier.type !== AcmeIdentifierType.DNS)) {
throw new AcmeUnsupportedIdentifierError({ message: "Only DNS identifiers are supported" });
}
if (
payload.identifiers.some(
(identifier) =>
!ValidDNSIdentifierRegex.test(identifier.value) ||
isPrivateIp(identifier.value) ||
(!getConfig().isDevelopmentMode && identifier.value.toLowerCase() === "localhost")
)
) {
throw new AcmeUnsupportedIdentifierError({ message: "Invalid DNS identifier" });
}
const order = await acmeOrderDAL.transaction(async (tx) => { const order = await acmeOrderDAL.transaction(async (tx) => {
const account = (await acmeAccountDAL.findByProjectIdAndAccountId(profileId, accountId))!; const account = (await acmeAccountDAL.findByProjectIdAndAccountId(profileId, accountId))!;
const createdOrder = await acmeOrderDAL.create( const createdOrder = await acmeOrderDAL.create(