PeculiarVentures / acme-ts / 40709199276

62%

push

github

fix!: reject padded and non-base64url JOSE and ACME values (#65)

RFC 7515 (section 2) and RFC 8555 (section 6.1) require base64url
without padding, and RFC 8555 says values with trailing '=' MUST be
rejected. pvtsutils' check let padded input through, and the CSR was
first parsed with x509's string parser, which also took PEM, hex and
standard base64.

- JWS protected header, payload and signature are decoded strictly.
- finalize decodes the CSR as base64url before parsing it and answers
  badCSR when it isn't; revokeCert answers malformed for a certificate
  that isn't base64url.
- The client still accepts a padded EAB HMAC key, which users copy from
  a CA portal.

BREAKING CHANGE: The server and @peculiar/jose reject base64url values
with '=' padding (JWS segments, the finalize csr, the revokeCert
certificate), and finalize no longer accepts a CSR in PEM, hex or
standard base64; it answers badCSR. Clients must send unpadded
base64url, as RFC 8555 requires.

562 of 1067 branches covered (52.67%)

Branch coverage included in aggregate %.

9 of 11 new or added lines in 5 files covered. (81.82%)

1622 of 2476 relevant lines covered (65.51%)

41.82 hits per line