node-opcua-pki 6.22.0 → 6.22.1

package/dist/bin/pki.mjs

@@ -430,17 +430,30 @@ function makeFingerprint(certificate) {
 function short(stringToShorten) {
   return stringToShorten.substring(0, 10);
 }
+function toFilenameLabel(commonName) {
+  const label = (commonName || "").normalize("NFKC").replace(disallowedInLabel, "_").replace(/[^\x20-\x7E]/g, "").slice(0, 64).trim();
+  return label || "certificate";
+}
 function buildIdealCertificateName(certificate) {
   const chain = coerceCertificateChain(certificate);
   const fingerprint2 = makeFingerprint(chain);
   try {
     const commonName = exploreCertificate(chain[0]).tbsCertificate.subject.commonName || "";
-    const sanitizedCommonName = commonName.replace(forbiddenChars, "_");
+    const sanitizedCommonName = toFilenameLabel(commonName);
     return `${sanitizedCommonName}[${fingerprint2}]`;
   } catch (_err) {
     return `invalid_certificate_[${fingerprint2}]`;
   }
 }
+function safeStoreJoin(folder, filename) {
+  const full = path2.resolve(folder, filename);
+  const base = path2.resolve(folder);
+  if (full !== base && !full.startsWith(base + path2.sep)) {
+    warningLog("refusing to write certificate outside its store folder:", filename);
+    throw new Error(`certificate filename escapes its store folder: ${filename}`);
+  }
+  return full;
+}
 function findMatchingIssuerKey(entries, wantedIssuerKey) {
   return entries.filter((entry) => {
     const info = getOrComputeInfo(entry);
@@ -502,7 +515,7 @@ function findIssuerCertificateInChain(certificate, chain) {
   }
   return null;
 }
-var configurationFileSimpleTemplate, fsWriteFile, forbiddenChars, ChainCompletionStatus, CertificateManager;
+var configurationFileSimpleTemplate, fsWriteFile, disallowedInLabel, ChainCompletionStatus, CertificateManager;
 var init_certificate_manager = __esm({
   "packages/node-opcua-pki/lib/pki/certificate_manager.ts"() {
     "use strict";
@@ -514,7 +527,7 @@ var init_certificate_manager = __esm({
     init_simple_config_template_cnf();
     configurationFileSimpleTemplate = simple_config_template_cnf_default;
     fsWriteFile = fs4.promises.writeFile;
-    forbiddenChars = /[\x00-\x1F<>:"/\\|?*]/g;
+    disallowedInLabel = /[^A-Za-z0-9._ -]/g;
     ChainCompletionStatus = /* @__PURE__ */ ((ChainCompletionStatus2) => {
       ChainCompletionStatus2["AlreadyComplete"] = "AlreadyComplete";
       ChainCompletionStatus2["ChainCompleted"] = "ChainCompleted";
@@ -999,7 +1012,7 @@ var init_certificate_manager = __esm({
             } catch (_err) {
               return "BadCertificateInvalid";
             }
-            const filename = path2.join(this.rejectedFolder, `${buildIdealCertificateName(leafCertificate)}.pem`);
+            const filename = safeStoreJoin(this.rejectedFolder, `${buildIdealCertificateName(leafCertificate)}.pem`);
             debugLog("certificate has never been seen before and is now rejected (untrusted) ", filename);
             await fsWriteFile(filename, toPem(chain, "CERTIFICATE"));
             this.#thumbs.rejected.set(fingerprint2, { certificate: leafCertificate, filename });
@@ -1407,7 +1420,7 @@ var init_certificate_manager = __esm({
         if (this.#thumbs.issuers.certs.has(fingerprint2)) {
           return "Good" /* Good */;
         }
-        const filename = path2.join(this.issuersCertFolder, `issuer_${buildIdealCertificateName(certificate)}.pem`);
+        const filename = safeStoreJoin(this.issuersCertFolder, `issuer_${buildIdealCertificateName(certificate)}.pem`);
         await fs4.promises.writeFile(filename, pemCertificate, "ascii");
         this.#thumbs.issuers.certs.set(fingerprint2, { certificate, filename });
         if (addInTrustList) {
@@ -1866,7 +1879,7 @@ var init_certificate_manager = __esm({
           let status = await this.#checkRejectedOrTrusted(certificate);
           if (status === "unknown") {
             const pem = toPem(chain, "CERTIFICATE");
-            const filename = path2.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
+            const filename = safeStoreJoin(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
             await fs4.promises.writeFile(filename, pem);
             this.#thumbs.rejected.set(fingerprint2, { certificate, filename });
             status = "rejected";
@@ -1883,7 +1896,7 @@ var init_certificate_manager = __esm({
               throw new Error(`#moveCertificate: certificate ${fingerprint2.substring(0, 10)} not found in ${status} index`);
             }
             const destFolder = newStatus === "trusted" ? this.trustedFolder : this.rejectedFolder;
-            const certificateDest = path2.join(destFolder, path2.basename(srcEntry.filename));
+            const certificateDest = safeStoreJoin(destFolder, path2.basename(srcEntry.filename));
             debugLog("#moveCertificate", fingerprint2.substring(0, 10), "old name", srcEntry.filename);
             debugLog("#moveCertificate", fingerprint2.substring(0, 10), "new name", certificateDest);
             await fs4.promises.rename(srcEntry.filename, certificateDest);
@@ -2640,8 +2653,32 @@ function passinArg(passphrase = "") {
 function renderForDisplay(file, args) {
   return [file, ...args].map((a) => a === "" || /[\s"'`$\\]/.test(a) ? JSON.stringify(a) : a).join(" ");
 }
+function hasUnsafeArgChar(value) {
+  for (const ch of value) {
+    const code = ch.codePointAt(0);
+    if (code < 32 || code === 127) {
+      return true;
+    }
+    if (code < 128) {
+      continue;
+    }
+    if (/[\p{L}\p{N}\p{M}]/u.test(ch)) {
+      continue;
+    }
+    return true;
+  }
+  return false;
+}
+function checkArgs(file, args) {
+  for (const value of [file, ...args]) {
+    if (typeof value === "string" && hasUnsafeArgChar(value)) {
+      throw new Error(`execute_openssl: refusing argument with an unexpected character: ${JSON.stringify(value)}`);
+    }
+  }
+}
 async function execute2(file, args, options) {
   const from = new Error();
+  checkArgs(file, args);
   options.cwd = options.cwd || process.cwd();
   if (!g_config.silent) {
     warningLog(chalk5.cyan("                  CWD         "), options.cwd);