Attachment 313491 Details for Bug 457983 – changed default to not allow user supplied extension values in cert requests

changed default to not allow user supplied extension values in cert requests

profileSecurityFix-dogtag.diff (text/plain), 1.92 KB, created by Christina Fu on 2008-08-05 21:59:21 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Christina Fu

Created: 2008-08-05 21:59:21 UTC

Size: 1.92 KB

patch

obsolete

>Index: src/com/netscape/cms/profile/common/EnrollProfile.java
>===================================================================
>--- src/com/netscape/cms/profile/common/EnrollProfile.java	(revision 72)
>+++ src/com/netscape/cms/profile/common/EnrollProfile.java	(working copy)
>@@ -933,7 +933,8 @@
>                     CertificateExtensions exts = new CertificateExtensions(extIn);
>                     if (exts != null) {
>                         CMS.debug("Set extensions " + exts);
>-                        info.set(X509CertInfo.EXTENSIONS, exts);
>+                        // info.set(X509CertInfo.EXTENSIONS, exts);
>+                        req.setExtData(REQUEST_EXTENSIONS, exts);
>                     }
>                 } else {
>                     CMS.debug("PKCS10 extension Not Found");
>Index: src/com/netscape/cms/profile/def/UserExtensionDefault.java
>===================================================================
>--- src/com/netscape/cms/profile/def/UserExtensionDefault.java	(revision 72)
>+++ src/com/netscape/cms/profile/def/UserExtensionDefault.java	(working copy)
>@@ -135,11 +135,20 @@
>     public void populate(IRequest request, X509CertInfo info)
>         throws EProfileException {
>         CertificateExtensions inExts = null;
>+        String oid = getConfig(CONFIG_OID);
> 
>         inExts = request.getExtDataInCertExts(IEnrollProfile.REQUEST_EXTENSIONS);
>+        if (inExts == null)
>+          return; 
>         Extension ext = getExtension(getConfig(CONFIG_OID), inExts);
>-        if (ext == null)
>+        if (ext == null) {
>+          CMS.debug("UserExtensionDefault: no user ext supplied for "+ oid);
>           return;
>-        addExtension(getConfig(CONFIG_OID), ext, info);
>+        }
>+
>+        // user supplied the ext that's allowed, replace the def set by system
>+        deleteExtension(oid, info);
>+        CMS.debug("UserExtensionDefault: using user supplied ext for "+ oid);
>+        addExtension(oid, ext, info);
>     }
> }

Actions: View

Attachments on bug 457983: 313491