awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix match logic

Browse Source
This commit is contained in:
Fang-Pen Lin
2025-11-11 12:14:48 -08:00
parent 204bf59b22
commit d70fa8f406
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
backend/src/ee/services/pki-acme/pki-acme-service.ts
View File

@@ -680,15 +680,16 @@ export const pkiAcmeServiceFactory = ({
tx
))!;
const csrIdentifierValues = new Set(
orderWithAuthorizations.authorizations
.map((auth) => auth.identifierValue.toLowerCase())
(certificateRequest.subjectAlternativeNames ?? [])
.map((san) => san.value.toLowerCase())
.concat([certificateRequest.commonName!.toLowerCase()])
);
const expectedIdentifierValues = new Set(
orderWithAuthorizations.authorizations.map((auth) => auth.identifierValue.toLowerCase())
);
if (
csrIdentifierValues.size !== orderWithAuthorizations.authorizations.length ||
!orderWithAuthorizations.authorizations.every((auth) =>
csrIdentifierValues.has(auth.identifierValue.toLowerCase())
)
csrIdentifierValues.size != expectedIdentifierValues.size ||
!csrIdentifierValues.isSubsetOf(expectedIdentifierValues)
) {
throw new AcmeBadCSRError({ detail: "Invalid CSR: Common name + SANs mismatch with order identifiers" });
}