Conversation
It did not require a full-length match, so empty or prefix tokens map to ECJPAKE would silently add that cipher to the configured list. Follow-up to fba9afe Reported by Codex Security
|
cc @jan2000 |
There was a problem hiding this comment.
Pull request overview
Fixes cipher-suite parsing for the mbedTLS backend so that TLS_ECJPAKE_WITH_AES_128_CCM_8 is only recognized on an exact, full-token match (preventing empty/prefix tokens from being interpreted as ECJPAKE).
Changes:
- Require full-length token match before mapping to
MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8. - Deduplicate the ECJPAKE suite string into a local constant to avoid repeating the literal.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Yup. Seems I made the same mistake in sectransp, but that one is already gone. Side note, having AI commenting in the PR seems like a distraction. "Deduplicate the ECJPAKE suite string into a local constant to avoid repeating the literal." Ugh. |
Agreed. Their reviews are useful however, and that's why we use them. As a side effect, both Copilot and Augment add their pointless explanations of the PR. |
It did not require a full-length match, so empty or prefix tokens map to ECJPAKE would silently add that cipher to the configured list.
Follow-up to fba9afe
Reported by Codex Security