Prevent infinite loops from breaks certificate paths building #210
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Cross-signing in the web pki apparently contains a lot of infinite loops that break the building of paths. This patch implement a simple []string that contains the CNs of certs that have already been seen in the path, to prevent the function from looping indefinitely.
autrilla
reviewed
Feb 9, 2017
database/certificate.go
Outdated
| // GetCertPaths returns the various certificates paths from the current cert to roots. | ||
| // It takes a certificate as argument that will be used as the start of the path, and | ||
| // a genealogy slice that contains the list of known parents, to prevent looping. When | ||
| // first invoked, the genealogy variable should be an empty []string. |
There was a problem hiding this comment.
nit: I think the public API should not include the []string, since after all we're asking to pass an empty slice the first call. I think we should instead have a private recursive function and make the public function create the slice for the caller.
autrilla
approved these changes
Feb 9, 2017
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Cross-signing in the web pki apparently contains a lot of infinite loops
that break the building of paths. This patch implement a simple []string
that contains the CNs of certs that have already been seen in the path,
to prevent the function from looping indefinitely.