node-opcua-pki 6.22.0 → 6.22.1

package/dist/index.d.mts

@@ -364,6 +364,8 @@ declare enum VerificationStatus {
 }
 declare function coerceCertificateChain(certificate: Certificate | Certificate[]): Certificate[];
 declare function makeFingerprint(certificate: Certificate | Certificate[] | CertificateRevocationList): string;
+declare function toFilenameLabel(commonName: string): string;
+declare function safeStoreJoin(folder: string, filename: string): string;
 /**
  * Check if the provided certificate acts as an issuer (CA)
  * @param certificate - the DER-encoded certificate
@@ -998,4 +1000,4 @@ declare function convertPFXtoPEM(pfxFile: Filename, pemFile: Filename, passphras
  */
 declare function dumpPFX(pfxFile: Filename, passphrase?: string): Promise<string>;
 
-export { type AddCertificateValidationOptions, CaBackend, CertificateAuthority, CertificateAuthorityCore, CertificateAuthorityCoreOptions, type CertificateAuthorityOptions, CertificateManager, type CertificateManagerEvents, type CertificateManagerOptions, CertificateManagerState, type CertificateStore, type ChainCompletionResult, ChainCompletionStatus, type CreatePFXOptions, CreateSelfSignCertificateParam, type CreateSelfSignCertificateParam1, type CrlStore, type ExtractPFXOptions, type ExtractPFXResult, Filename, KeySize, OpenSslCaBackend, Params, PrivateKeyPassphrase, PrivateKeyProvider, ProcessAltNamesParam, VerificationStatus, type VerifyCertificateOptions, coerceCertificateChain, convertPFXtoPEM, createPFX, dumpPFX, extractAllFromPFX, extractCACertificatesFromPFX, extractCertificateFromPFX, extractPrivateKeyFromPFX, findIssuerCertificateInChain, install_prerequisite, isIntermediateIssuer, isIssuer, isRootIssuer, makeFingerprint };
+export { type AddCertificateValidationOptions, CaBackend, CertificateAuthority, CertificateAuthorityCore, CertificateAuthorityCoreOptions, type CertificateAuthorityOptions, CertificateManager, type CertificateManagerEvents, type CertificateManagerOptions, CertificateManagerState, type CertificateStore, type ChainCompletionResult, ChainCompletionStatus, type CreatePFXOptions, CreateSelfSignCertificateParam, type CreateSelfSignCertificateParam1, type CrlStore, type ExtractPFXOptions, type ExtractPFXResult, Filename, KeySize, OpenSslCaBackend, Params, PrivateKeyPassphrase, PrivateKeyProvider, ProcessAltNamesParam, VerificationStatus, type VerifyCertificateOptions, coerceCertificateChain, convertPFXtoPEM, createPFX, dumpPFX, extractAllFromPFX, extractCACertificatesFromPFX, extractCertificateFromPFX, extractPrivateKeyFromPFX, findIssuerCertificateInChain, install_prerequisite, isIntermediateIssuer, isIssuer, isRootIssuer, makeFingerprint, safeStoreJoin, toFilenameLabel };

package/dist/index.d.ts

@@ -364,6 +364,8 @@ declare enum VerificationStatus {
 }
 declare function coerceCertificateChain(certificate: Certificate | Certificate[]): Certificate[];
 declare function makeFingerprint(certificate: Certificate | Certificate[] | CertificateRevocationList): string;
+declare function toFilenameLabel(commonName: string): string;
+declare function safeStoreJoin(folder: string, filename: string): string;
 /**
  * Check if the provided certificate acts as an issuer (CA)
  * @param certificate - the DER-encoded certificate
@@ -998,4 +1000,4 @@ declare function convertPFXtoPEM(pfxFile: Filename, pemFile: Filename, passphras
  */
 declare function dumpPFX(pfxFile: Filename, passphrase?: string): Promise<string>;
 
-export { type AddCertificateValidationOptions, CaBackend, CertificateAuthority, CertificateAuthorityCore, CertificateAuthorityCoreOptions, type CertificateAuthorityOptions, CertificateManager, type CertificateManagerEvents, type CertificateManagerOptions, CertificateManagerState, type CertificateStore, type ChainCompletionResult, ChainCompletionStatus, type CreatePFXOptions, CreateSelfSignCertificateParam, type CreateSelfSignCertificateParam1, type CrlStore, type ExtractPFXOptions, type ExtractPFXResult, Filename, KeySize, OpenSslCaBackend, Params, PrivateKeyPassphrase, PrivateKeyProvider, ProcessAltNamesParam, VerificationStatus, type VerifyCertificateOptions, coerceCertificateChain, convertPFXtoPEM, createPFX, dumpPFX, extractAllFromPFX, extractCACertificatesFromPFX, extractCertificateFromPFX, extractPrivateKeyFromPFX, findIssuerCertificateInChain, install_prerequisite, isIntermediateIssuer, isIssuer, isRootIssuer, makeFingerprint };
+export { type AddCertificateValidationOptions, CaBackend, CertificateAuthority, CertificateAuthorityCore, CertificateAuthorityCoreOptions, type CertificateAuthorityOptions, CertificateManager, type CertificateManagerEvents, type CertificateManagerOptions, CertificateManagerState, type CertificateStore, type ChainCompletionResult, ChainCompletionStatus, type CreatePFXOptions, CreateSelfSignCertificateParam, type CreateSelfSignCertificateParam1, type CrlStore, type ExtractPFXOptions, type ExtractPFXResult, Filename, KeySize, OpenSslCaBackend, Params, PrivateKeyPassphrase, PrivateKeyProvider, ProcessAltNamesParam, VerificationStatus, type VerifyCertificateOptions, coerceCertificateChain, convertPFXtoPEM, createPFX, dumpPFX, extractAllFromPFX, extractCACertificatesFromPFX, extractCertificateFromPFX, extractPrivateKeyFromPFX, findIssuerCertificateInChain, install_prerequisite, isIntermediateIssuer, isIssuer, isRootIssuer, makeFingerprint, safeStoreJoin, toFilenameLabel };

package/dist/index.js

@@ -59,7 +59,9 @@ __export(lib_exports, {
   isRootIssuer: () => isRootIssuer,
   makeFingerprint: () => makeFingerprint,
   quote: () => quote,
-  resolvePrivateKeyPassphrase: () => resolvePrivateKeyPassphrase
+  resolvePrivateKeyPassphrase: () => resolvePrivateKeyPassphrase,
+  safeStoreJoin: () => safeStoreJoin,
+  toFilenameLabel: () => toFilenameLabel
 });
 module.exports = __toCommonJS(lib_exports);
 var import_node_opcua_crypto10 = require("node-opcua-crypto");
@@ -1065,8 +1067,32 @@ function passinArg(passphrase = "") {
 function renderForDisplay(file, args) {
   return [file, ...args].map((a) => a === "" || /[\s"'`$\\]/.test(a) ? JSON.stringify(a) : a).join(" ");
 }
+function hasUnsafeArgChar(value) {
+  for (const ch of value) {
+    const code = ch.codePointAt(0);
+    if (code < 32 || code === 127) {
+      return true;
+    }
+    if (code < 128) {
+      continue;
+    }
+    if (/[\p{L}\p{N}\p{M}]/u.test(ch)) {
+      continue;
+    }
+    return true;
+  }
+  return false;
+}
+function checkArgs(file, args) {
+  for (const value of [file, ...args]) {
+    if (typeof value === "string" && hasUnsafeArgChar(value)) {
+      throw new Error(`execute_openssl: refusing argument with an unexpected character: ${JSON.stringify(value)}`);
+    }
+  }
+}
 async function execute2(file, args, options) {
   const from = new Error();
+  checkArgs(file, args);
   options.cwd = options.cwd || process.cwd();
   if (!g_config.silent) {
     warningLog(import_chalk4.default.cyan("                  CWD         "), options.cwd);
@@ -3001,18 +3027,31 @@ function makeFingerprint(certificate) {
 function short(stringToShorten) {
   return stringToShorten.substring(0, 10);
 }
-var forbiddenChars = /[\x00-\x1F<>:"/\\|?*]/g;
+var disallowedInLabel = /[^A-Za-z0-9._ -]/g;
+function toFilenameLabel(commonName) {
+  const label = (commonName || "").normalize("NFKC").replace(disallowedInLabel, "_").replace(/[^\x20-\x7E]/g, "").slice(0, 64).trim();
+  return label || "certificate";
+}
 function buildIdealCertificateName(certificate) {
   const chain = coerceCertificateChain(certificate);
   const fingerprint = makeFingerprint(chain);
   try {
     const commonName = (0, import_node_opcua_crypto8.exploreCertificate)(chain[0]).tbsCertificate.subject.commonName || "";
-    const sanitizedCommonName = commonName.replace(forbiddenChars, "_");
+    const sanitizedCommonName = toFilenameLabel(commonName);
     return `${sanitizedCommonName}[${fingerprint}]`;
   } catch (_err) {
     return `invalid_certificate_[${fingerprint}]`;
   }
 }
+function safeStoreJoin(folder, filename) {
+  const full = import_node_path8.default.resolve(folder, filename);
+  const base = import_node_path8.default.resolve(folder);
+  if (full !== base && !full.startsWith(base + import_node_path8.default.sep)) {
+    warningLog("refusing to write certificate outside its store folder:", filename);
+    throw new Error(`certificate filename escapes its store folder: ${filename}`);
+  }
+  return full;
+}
 function findMatchingIssuerKey(entries, wantedIssuerKey) {
   return entries.filter((entry) => {
     const info = getOrComputeInfo(entry);
@@ -3588,7 +3627,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
         } catch (_err) {
           return "BadCertificateInvalid";
         }
-        const filename = import_node_path8.default.join(this.rejectedFolder, `${buildIdealCertificateName(leafCertificate)}.pem`);
+        const filename = safeStoreJoin(this.rejectedFolder, `${buildIdealCertificateName(leafCertificate)}.pem`);
         debugLog("certificate has never been seen before and is now rejected (untrusted) ", filename);
         await fsWriteFile(filename, (0, import_node_opcua_crypto8.toPem)(chain, "CERTIFICATE"));
         this.#thumbs.rejected.set(fingerprint, { certificate: leafCertificate, filename });
@@ -3996,7 +4035,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
     if (this.#thumbs.issuers.certs.has(fingerprint)) {
       return "Good" /* Good */;
     }
-    const filename = import_node_path8.default.join(this.issuersCertFolder, `issuer_${buildIdealCertificateName(certificate)}.pem`);
+    const filename = safeStoreJoin(this.issuersCertFolder, `issuer_${buildIdealCertificateName(certificate)}.pem`);
     await import_node_fs11.default.promises.writeFile(filename, pemCertificate, "ascii");
     this.#thumbs.issuers.certs.set(fingerprint, { certificate, filename });
     if (addInTrustList) {
@@ -4455,7 +4494,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
       let status = await this.#checkRejectedOrTrusted(certificate);
       if (status === "unknown") {
         const pem = (0, import_node_opcua_crypto8.toPem)(chain, "CERTIFICATE");
-        const filename = import_node_path8.default.join(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
+        const filename = safeStoreJoin(this.rejectedFolder, `${buildIdealCertificateName(certificate)}.pem`);
         await import_node_fs11.default.promises.writeFile(filename, pem);
         this.#thumbs.rejected.set(fingerprint, { certificate, filename });
         status = "rejected";
@@ -4472,7 +4511,7 @@ var CertificateManager = class _CertificateManager extends import_node_events.Ev
           throw new Error(`#moveCertificate: certificate ${fingerprint.substring(0, 10)} not found in ${status} index`);
         }
         const destFolder = newStatus === "trusted" ? this.trustedFolder : this.rejectedFolder;
-        const certificateDest = import_node_path8.default.join(destFolder, import_node_path8.default.basename(srcEntry.filename));
+        const certificateDest = safeStoreJoin(destFolder, import_node_path8.default.basename(srcEntry.filename));
         debugLog("#moveCertificate", fingerprint.substring(0, 10), "old name", srcEntry.filename);
         debugLog("#moveCertificate", fingerprint.substring(0, 10), "new name", certificateDest);
         await import_node_fs11.default.promises.rename(srcEntry.filename, certificateDest);
@@ -4963,6 +5002,8 @@ async function dumpPFX(pfxFile, passphrase = "") {
   isRootIssuer,
   makeFingerprint,
   quote,
-  resolvePrivateKeyPassphrase
+  resolvePrivateKeyPassphrase,
+  safeStoreJoin,
+  toFilenameLabel
 });
 //# sourceMappingURL=index.js.map