node-opcua / node-opcua-pki / 35335711060

92%

push

github

fix(security): reject best-fit-unsafe characters in openssl arguments

On a Windows ANSI code page a look-alike Unicode character (a full-width
quote, a non-breaking space, ...) can be best-fit mapped onto a plain ASCII
delimiter when a child process rebuilds its argument list, which lets a
crafted certificate Common Name reach openssl as extra arguments even without
a shell.

Two layers: execute_openssl now refuses any argument with an ASCII control
character or a non-ASCII punctuation/symbol/separator character before spawn
(non-ASCII letters and digits stay allowed, so accented PKI paths keep
working); the stored-filename label built from a certificate CN is now an
allowlist (NFKC-fold, [A-Za-z0-9._ -], length-capped) instead of a denylist.

Adds a regression test covering the bypass classes and the no-false-positive
case for an accented path.

695 of 916 branches covered (75.87%)

20 of 21 new or added lines in 2 files covered. (95.24%)

1888 of 2064 relevant lines covered (91.47%)

487.4 hits per line