Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x509, ssl, pkcs7: try to parse as DER-encoding first #442

Merged
merged 1 commit into from
May 25, 2021
Merged

x509, ssl, pkcs7: try to parse as DER-encoding first #442

merged 1 commit into from
May 25, 2021

Commits on May 19, 2021

  1. x509, ssl, pkcs7: try to parse as DER-encoding first 

    Methods that take both PEM-encoding and DER-encoding have not been
consistent in the order in which encoding to attempt to parse.

A DER-encoding may contain a valid PEM block ("\n-----BEGIN ..-----" to
"-----END ...-----") embedded within it. Also, the PEM-encoding parser
allows arbitrary data around the PEM block and silently skips it. As a
result, attempting to parse data in DER-encoding as PEM-encoding first
can incorrectly finds the embedded PEM block instead.

This commit ensures that DER encoding will always be attempted before
PEM encoding. OpenSSL::X509::Certificate is one of the updated classes.
With this, the following will always be true:

    # obj is an OpenSSL::X509::Certificate
    obj == OpenSSL::X509::Certificate.new(obj.to_der)
    obj == OpenSSL::X509::Certificate.new(obj.to_pem)
    @rhenium
    rhenium committed May 19, 2021
    Configuration menu
    Copy the full SHA
    b280eb1 View commit details
    Browse the repository at this point in the history