diff options
author | Kazuki Yamaguchi <k@rhe.jp> | 2021-05-19 17:58:18 +0900 |
---|---|---|
committer | Kazuki Yamaguchi <k@rhe.jp> | 2021-07-18 17:44:54 +0900 |
commit | a01daab656a3d32b52bd236503e3d9aebaf39483 (patch) | |
tree | f5ead5f4c70b78ba28f1f19b1cab20d7e53cde37 /test/openssl | |
parent | 29ad4ab3d0407b99bbdad654b2138527859694cf (diff) |
[ruby/openssl] x509, ssl, pkcs7: try to parse as DER-encoding first
Methods that take both PEM-encoding and DER-encoding have not been
consistent in the order in which encoding to attempt to parse.
A DER-encoding may contain a valid PEM block ("\n-----BEGIN ..-----" to
"-----END ...-----") embedded within it. Also, the PEM-encoding parser
allows arbitrary data around the PEM block and silently skips it. As a
result, attempting to parse data in DER-encoding as PEM-encoding first
can incorrectly finds the embedded PEM block instead.
This commit ensures that DER encoding will always be attempted before
PEM encoding. OpenSSL::X509::Certificate is one of the updated classes.
With this, the following will always be true:
# obj is an OpenSSL::X509::Certificate
obj == OpenSSL::X509::Certificate.new(obj.to_der)
obj == OpenSSL::X509::Certificate.new(obj.to_pem)
https://github.com/ruby/openssl/commit/b280eb1fd0
Diffstat (limited to 'test/openssl')
-rw-r--r-- | test/openssl/test_x509cert.rb | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/test/openssl/test_x509cert.rb b/test/openssl/test_x509cert.rb index 848a314c9f..70fe9d4419 100644 --- a/test/openssl/test_x509cert.rb +++ b/test/openssl/test_x509cert.rb @@ -245,6 +245,18 @@ class OpenSSL::TestX509Certificate < OpenSSL::TestCase } end + def test_read_der_then_pem + cert1 = issue_cert(@ca, @rsa2048, 1, [], nil, nil) + exts = [ + # A new line before PEM block + ["nsComment", "Another certificate:\n" + cert1.to_pem], + ] + cert2 = issue_cert(@ca, @rsa2048, 2, exts, nil, nil) + + assert_equal cert2, OpenSSL::X509::Certificate.new(cert2.to_der) + assert_equal cert2, OpenSSL::X509::Certificate.new(cert2.to_pem) + end + def test_eq now = Time.now cacert = issue_cert(@ca, @rsa1024, 1, [], nil, nil, |