awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 20:27:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

RE2 fixes

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-08-28 09:21:45 -03:00
parent 13b20806ba
commit 5eee99e9ac
4 changed files with 10 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/lib/api-docs/constants.ts
+1 -1
View File
@@ -2320,7 +2320,7 @@ export const AppConnections = {
password: "The password used to access Azure ADCS.", password: "The password used to access Azure ADCS.",
sslRejectUnauthorized: sslRejectUnauthorized:
"Whether or not to reject unauthorized SSL certificates (true/false). Set to false only in test environments with self-signed certificates.", "Whether or not to reject unauthorized SSL certificates (true/false). Set to false only in test environments with self-signed certificates.",
sslCertificate: "The SSL certificate (PEM format) to use for secure connection with a self-signed certificate." sslCertificate: "The SSL certificate (PEM format) to use for secure connection."
} }
} }
}; };
backend/src/server/routes/v1/pki-subscriber-router.ts
+6 -6
View File
@@ -142,7 +142,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
'Organizational Unit contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t' 'Organizational Unit contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
) )
.regex( .regex(
/^[^\s-_.]+.*[^\s-_.]+$|^[^\s-_.]{1}$/, new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
"Organizational Unit cannot start or end with spaces, hyphens, underscores, or periods" "Organizational Unit cannot start or end with spaces, hyphens, underscores, or periods"
) )
.optional() .optional()
@@ -164,7 +164,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
'State contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t' 'State contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
) )
.regex( .regex(
/^[^\s-_.]+.*[^\s-_.]+$|^[^\s-_.]{1}$/, new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
"State cannot start or end with spaces, hyphens, underscores, or periods" "State cannot start or end with spaces, hyphens, underscores, or periods"
) )
.optional() .optional()
@@ -179,7 +179,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
'Locality contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t' 'Locality contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
) )
.regex( .regex(
/^[^\s-_.]+.*[^\s-_.]+$|^[^\s-_.]{1}$/, new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
"Locality cannot start or end with spaces, hyphens, underscores, or periods" "Locality cannot start or end with spaces, hyphens, underscores, or periods"
) )
.optional() .optional()
@@ -310,7 +310,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
'Organizational Unit contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t' 'Organizational Unit contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
) )
.regex( .regex(
/^[^\s-_.]+.*[^\s-_.]+$|^[^\s-_.]{1}$/, new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
"Organizational Unit cannot start or end with spaces, hyphens, underscores, or periods" "Organizational Unit cannot start or end with spaces, hyphens, underscores, or periods"
) )
.optional() .optional()
@@ -332,7 +332,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
'State contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t' 'State contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
) )
.regex( .regex(
/^[^\s-_.]+.*[^\s-_.]+$|^[^\s-_.]{1}$/, new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
"State cannot start or end with spaces, hyphens, underscores, or periods" "State cannot start or end with spaces, hyphens, underscores, or periods"
) )
.optional() .optional()
@@ -347,7 +347,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
'Locality contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t' 'Locality contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
) )
.regex( .regex(
/^[^\s-_.]+.*[^\s-_.]+$|^[^\s-_.]{1}$/, new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
"Locality cannot start or end with spaces, hyphens, underscores, or periods" "Locality cannot start or end with spaces, hyphens, underscores, or periods"
) )
.optional() .optional()
backend/src/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-fns.ts
+1 -1
View File
@@ -923,7 +923,7 @@ export const AzureAdCsCertificateAuthorityFns = ({
if (retryCount === maxRetries) { if (retryCount === maxRetries) {
throw new BadRequestError({ throw new BadRequestError({
message: `Certificate request submitted with ID ${submissionResponse.certificateId} but failed to retrieve after ${maxRetries} attempts. The certificate may still be pending approval or processing. Last error: ${lastError?.message || "Unknown error"}. For manual approval scenarios, consider implementing a background polling mechanism.` message: `Certificate request submitted with ID ${submissionResponse.certificateId} but failed to retrieve after ${maxRetries} attempts. The certificate may still be pending approval or processing. Last error: ${lastError?.message || "Unknown error"}.`
}); });
} }
} }
docs/documentation/platform/pki/azure-adcs.mdx
+2 -3
View File
@@ -137,7 +137,7 @@ If a certificate request requires manual approval:
4. **No background polling**: Currently, Infisical does not check for certificates that might be approved hours or days later 4. **No background polling**: Currently, Infisical does not check for certificates that might be approved hours or days later
<Info> <Info>
**Future Enhancement**: Background polling for delayed certificate approvals is planned for future releases. For now, configure your ADCS templates for immediate issuance to ensure smooth certificate provisioning. **Future Enhancement**: Background polling for delayed certificate approvals is planned for future releases.
</Info> </Info>
### Certificate Revocation ### Certificate Revocation
@@ -200,8 +200,7 @@ This allows Infisical to control certificate expiration dates directly.
- Ensure network connectivity to ADCS server - Ensure network connectivity to ADCS server
**SSL/TLS Certificate Errors** **SSL/TLS Certificate Errors**
- For ADCS servers with self-signed certificates: disable "Reject Unauthorized" in the SSL tab of your Azure ADCS app connection, or provide the certificate in PEM format - For ADCS servers with self-signed or private certificates: disable "Reject Unauthorized" in the SSL tab of your Azure ADCS app connection, or provide the certificate in PEM format
- For production environments, consider installing proper SSL certificates on your ADCS server instead of disabling SSL verification
- Common SSL errors: `UNABLE_TO_VERIFY_LEAF_SIGNATURE`, `SELF_SIGNED_CERT_IN_CHAIN`, `CERT_HAS_EXPIRED` - Common SSL errors: `UNABLE_TO_VERIFY_LEAF_SIGNATURE`, `SELF_SIGNED_CERT_IN_CHAIN`, `CERT_HAS_EXPIRED`
- The SSL configuration applies to all HTTPS communications between Infisical and your ADCS server - The SSL configuration applies to all HTTPS communications between Infisical and your ADCS server
- Only HTTPS URLs are supported - HTTP connections are not allowed for security reasons - Only HTTPS URLs are supported - HTTP connections are not allowed for security reasons