crypto/x509: unexpected handling of escape characters

[onepeople158]

Go version

go version go1.24.1 linux/amd64

Output of go env in your module/workspace:

CN=test,OU=Class 3 Public Primary Certification Authority,O=VeriSign\\,L=test,ST=test,C=US
2025-01-01 00:00:00 +0000 UTC
2025-12-01 00:00:00 +0000 UTC
1

What did you do?

Hello Developer： I have a CRL file, and the "O" field in its issuer section contains an escape character. The value of the "O" field is 'VeriSign\'. When I use Go to parse this CRL file, Go interprets the "O" field as 'VeriSign\\'. However, when I open the CRL file as a .crl file, the "O" field in the issuer section shows as 'VeriSign\'. Therefore, I suspect that the handling of the escape character '\\' by Go may not be entirely reasonable.

What did you see happen?

The issuer field is parsed as Issuer: CN=test,OU=Class 3 Public Primary Certification Authority,O=VeriSign\\,L=test,ST=test,C=US
.

What did you expect to see?

crl_file_.zip

[dmitshur]

In the issue report you mention "I use Go to parse this CRL file, Go interprets". Can you please provide a snippet of code for that? In particular, that code will help determine if the problem is in the crypto/x509 package, or how it's being used.

Please see https://go.dev/wiki/Questions for asking questions about Go.

[onepeople158]

In the issue report you mention "I use Go to parse this CRL file, Go interprets". Can you please provide a snippet of code for that? In particular, that code will help determine if the problem is in the crypto/x509 package, or how it's being used.

Please see https://go.dev/wiki/Questions for asking questions about Go.

package main

import (
    "crypto/x509"
    "encoding/asn1"
    "fmt"
    "io/ioutil"
    "os"
    "math/big"
)

func main() {

    derBytes, err := ioutil.ReadFile("crl_file_.der")
    if err != nil {
        fmt.Println(err)
        os.Exit(1)
    }

    crl, err := x509.ParseRevocationList(derBytes)
    if err != nil {
        fmt.Println(err)
        os.Exit(1)
    }
    fmt.Printf("%s\n",crl.Issuer)
    fmt.Printf("%s\n",crl.ThisUpdate)
    fmt.Printf("%s\n", crl.NextUpdate)
    fmt.Printf("%d\n", len(crl.RevokedCertificates))
}

[dmitshur]

Thanks. The value of crl.Issuer.Organization contains only one backslash character:

Organization:[]string{`VeriSign\`}

And the String method prints that one backslash in escaped format. Here's a smaller repro:

package main

import (
	"crypto/x509/pkix"
	"fmt"
)

func main() {
	name := pkix.Name{Organization: []string{`abc\`}}
	fmt.Println(name)

	// Output: O=abc\\
}

(https://go.dev/play/p/TULVLleyOCY)

CC @golang/security.

[onepeople158]

Thanks. The value of contains only one backslash character:crl.Issuer.Organization

Organization:[]string{`VeriSign\`}

And the String method prints that one backslash in escaped format. Here's a smaller repro:

package main

import (
"crypto/x509/pkix"
"fmt"
)

func main() {
name := pkix.Name{Organization: []string{abc\}}
fmt.Println(name)

// Output: O=abc\
}
(https://go.dev/play/p/TULVLleyOCY)

CC @golang/security.
Hello, developer. Do you mean that it is normal for the Name parsed by Go to appear in its raw string format?

[seankhliao]

see https://www.rfc-editor.org/rfc/rfc2253#section-2.4

I believe this this working as intended.

[onepeople158]

see https://www.rfc-editor.org/rfc/rfc2253#section-2.4

I believe this this working as intended.

Thank you for your reply.