PeculiarVentures / x509 / 40518060855

91%

push

github

fix!: reject trailing data after DER-encoded input (#163)

AsnConvert.parse reads only the first ASN.1 element, so a certificate
with bytes appended after it (another ASN.1 object, or garbage) parsed
and verified, and rawData and thumbprints kept the extra bytes (#129).
AsnData, the base of certificates, CRLs, CSRs, public keys, extensions,
attributes and general names, and X509Certificates.import (PKCS#7) now
compare the first element's encoded length with the input length and
throw when data follows. Indefinite-length BER input has no length in
its header and is not checked.

BREAKING CHANGE: DER/BER input that continues after the encoded
structure throws "Unexpected data after the ASN.1 structure: <n>
trailing bytes" instead of being accepted with the extra bytes kept in
rawData.

809 of 971 branches covered (83.32%)

Branch coverage included in aggregate %.

18 of 18 new or added lines in 3 files covered. (100.0%)

1663 of 1785 relevant lines covered (93.17%)

708.4 hits per line