PeculiarVentures / PKI.js / 30248018887

72%

push

github

fix(ocsp): add OCSP responder authorization checks (RFC 6960 §4.2.2.2) (#502)

* chore: update dependencies and tooling

- Upgrade devDependencies: eslint 10, typescript 6, rollup 4, mocha 11, etc.
- Upgrade dependencies: asn1js 3.0.10, @noble/hashes 1.8.0, pvutils 1.1.5
- Switch moduleResolution to 'bundler' in tsconfig.json
- Add X25519 key generation overload to CryptoEngine
- Refine getRandomValues type signatures (Exclude<BufferSource, ArrayBuffer>)
- Add mocha types to tsconfig.json

* fix(ocsp): add OCSP responder authorization checks

Previously verify() only validated the signer's certificate chain and
cryptographic signature, but did NOT check that the signer is actually
authorized to respond for the certificate in question (RFC 6960 §4.2.2.2).

This commit adds mandatory authorization checks:
- Direct issuer: the signer MUST match the CertID issuer
- Delegated responder: the signer MUST chain to an issuer matching the
  CertID AND carry id-kp-OCSPSigning EKU + digitalSignature KeyUsage
- Trusted responder: explicitly pinned via new trustedResponders param

Breaking changes to verify():
- Now throws on unauthorized responders (previously returned true)
- New trustedResponders parameter for explicit responder pinning
- Returns false only for cryptographic signature mismatch
- Surfaces hard errors (unsupported algorithm, chain failure) as thrown
  exceptions rather than silently mapping to false
- Supports multiple signer candidates (re-issued/ambiguous byName)

Additional changes:
- Multi-candidate responder resolution (byName/byKey)
- DER-identity helpers for cross-signed/duplicate cert handling
- Comprehensive security regression test suite (13 test groups)

* style: fix lint errors (no-useless-assignment, preserve-caught-error)

- Remove useless initializers (= 0, = '', = null) where values are
  unconditionally overwritten before first read
- Add { cause: e } to re-thrown Error in PublicKeyInfo.importKey
- Replace padded[i++] with padded[... (continued)

3329 of 5512 branches covered (60.4%)

155 of 155 new or added lines in 2 files covered. (100.0%)

5753 of 7943 relevant lines covered (72.43%)

1873.95 hits per line