codecov[bot]
commented
1 year ago Codecov Report
Merging #278 (5bf67ff) into main (4a71d47) will increase coverage by
0.23%. The diff coverage is100.00%.
@@ Coverage Diff @@
## main #278 +/- ##
==========================================
+ Coverage 50.62% 50.86% +0.23%
==========================================
Files 18 18
Lines 3751 3769 +18
==========================================
+ Hits 1899 1917 +18
Misses 1852 1852 | Files Changed | Coverage Δ | |
|---|---|---|
| src/signed_data.rs | 100.00% <ø> (ø) |
|
| src/verify_cert.rs | 94.40% <100.00%> (+0.33%) |
:arrow_up: |
:mega: We’re building smart automated test selection to slash your CI/CD build times. Learn more
cpu
briansmith
Prior to this branch parsing and processing certificate name constraints was done before validating a chain of signatures to a known trust anchor. This increases the attack surface of these features, allowing an adversary to force webpki to process name constraints on a crafted certificate without needing to have that certificate issued by a trusted entity.
This branch moves the parsing and processing of name constraints to after building and verifying the chain of signatures to reduce the potential for mischief. It's a backport of part of the work from https://github.com/rustls/webpki/pull/165, however test coverage and constraining the number of comparisons using a budget limit are omitted due to the general state of name constraint support (c.f. https://github.com/briansmith/webpki/pull/226).