awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4834 from Infisical/fix/pki-csr-key-usage-check

Browse Source 
Fix CSR KU/EKU check
This commit is contained in:
carlosmonastyrski
2025-11-10 17:11:50 -03:00
committed by GitHub
parent 821ab27273 2e0a404e52
commit e4c2e78d86
3 changed files with 6 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
backend/src/services/certificate-template-v2/certificate-template-v2-service.test.ts
View File

@@ -613,39 +613,6 @@ describe("CertificateTemplateV2Service", () => {
expect(result.isValid).toBe(true);
});
it("should handle camelCase key usage mapping correctly", async () => {
const templateWithOptionalUsages = {
...sampleTemplate,
keyUsages: {
requiredUsages: {
all: [CertKeyUsageType.DIGITAL_SIGNATURE, CertKeyUsageType.NON_REPUDIATION, CertKeyUsageType.KEY_AGREEMENT]
},
optionalUsages: { all: [CertKeyUsageType.CRL_SIGN, CertKeyUsageType.DECIPHER_ONLY] }
},
extendedKeyUsages: {
requiredUsages: { all: [CertExtendedKeyUsageType.CLIENT_AUTH, CertExtendedKeyUsageType.CODE_SIGNING] },
optionalUsages: { all: [CertExtendedKeyUsageType.SERVER_AUTH, CertExtendedKeyUsageType.OCSP_SIGNING] }
}
};
mockCertificateTemplateV2DAL.findById.mockResolvedValue(templateWithOptionalUsages);
const requestWithCamelCaseUsages = {
...validRequest,
keyUsages: [
CertKeyUsageType.DIGITAL_SIGNATURE,
CertKeyUsageType.NON_REPUDIATION,
CertKeyUsageType.KEY_AGREEMENT,
CertKeyUsageType.CRL_SIGN,
CertKeyUsageType.DECIPHER_ONLY
],
extendedKeyUsages: [CertExtendedKeyUsageType.CLIENT_AUTH, CertExtendedKeyUsageType.CODE_SIGNING]
};
const result = await service.validateCertificateRequest("template-123", requestWithCamelCaseUsages);
expect(result.isValid).toBe(true);
expect(result.errors).toHaveLength(0);
});
it("should validate wildcard patterns in allow attributes", async () => {
const wildcardTemplate = {
...sampleTemplate,

9
backend/src/services/certificate-template-v2/certificate-template-v2-service.ts
View File

@@ -482,7 +482,7 @@ export const certificateTemplateV2ServiceFactory = ({
}
// Check ALLOWED key usages - if present, all usages must be in allowed list
if (request.keyUsages && keyUsagePolicy && keyUsagePolicy.allowed && keyUsagePolicy.allowed.length > 0) {
if (request.keyUsages && keyUsagePolicy) {
const allAllowedUsages = [...(keyUsagePolicy.required || []), ...(keyUsagePolicy.allowed || [])];
const invalidUsages = request.keyUsages.filter((usage) => !allAllowedUsages.includes(usage));
if (invalidUsages.length > 0) {
@@ -517,12 +517,7 @@ export const certificateTemplateV2ServiceFactory = ({
}
// Check ALLOWED extended key usages - if present, all usages must be in allowed list
if (
request.extendedKeyUsages &&
extendedKeyUsagePolicy &&
extendedKeyUsagePolicy.allowed &&
extendedKeyUsagePolicy.allowed.length > 0
) {
if (request.extendedKeyUsages && extendedKeyUsagePolicy) {
const allAllowedExtendedUsages = [
...(extendedKeyUsagePolicy.required || []),
...(extendedKeyUsagePolicy.allowed || [])

4
backend/src/services/certificate-v3/certificate-v3-service.ts
View File

@@ -543,6 +543,10 @@ export const certificateV3ServiceFactory = ({
const { keyAlgorithm: extractedKeyAlgorithm, signatureAlgorithm: extractedSignatureAlgorithm } =
extractAlgorithmsFromCSR(csr);
mappedCertificateRequest.keyAlgorithm = extractedKeyAlgorithm;
mappedCertificateRequest.signatureAlgorithm = extractedSignatureAlgorithm;
mappedCertificateRequest.validity = validity;
const validationResult = await certificateTemplateV2Service.validateCertificateRequest(
profile.certificateTemplateId,
mappedCertificateRequest