Skip to content

Error on empty EKU extensions - #382

Merged
djc merged 2 commits into
mainfrom
empty-eku
Sep 15, 2025
Merged

djc merged 2 commits into
mainfrom
empty-eku

Conversation

@djc

@djc djc commented Sep 15, 2025

Copy link
Copy Markdown
Member

No description provided.

@djc
djc requested review from cpu and ctz September 15, 2025 13:07
@codecov

codecov Bot commented Sep 15, 2025 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 93.75000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 97.43%. Comparing base (064a68b) to head (8c91077).
⚠️ Report is 3 commits behind head on main.

Files with missing lines Patch % Lines
src/error.rs 0.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #382      +/-   ##
==========================================
- Coverage   97.45%   97.43%   -0.02%     
==========================================
  Files          20       20              
  Lines        4088     4101      +13     
==========================================
+ Hits         3984     3996      +12     
- Misses        104      105       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@djc
djc added this pull request to the merge queue Sep 15, 2025
Merged via the queue into main with commit b88328a Sep 15, 2025
38 of 40 checks passed
@djc
djc deleted the empty-eku branch September 15, 2025 13:27
@djc

djc commented Sep 15, 2025

Copy link
Copy Markdown
Member Author
  • Published rustls-webpki v0.103.6 at registry crates-io
  • [new tag] v/0.103.6 -> v/0.103.6
  • Release notes

Comment thread src/verify_cert.rs
Comment on lines +947 to +948
let mut empty_eku = untrusted::Reader::new(untrusted::Input::from(&[]));
let validator = KeyUsage::required_if_present(EKU_SERVER_AUTH);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FWIW, I also spot-checked this against a full DER encoded certificate I made with pyca/cryptography adding the EKU extension the same way as the upstream x509-limbo test case and the expected error occurs 👍

#206 is the broader tracking issue to bring that project's coverage in-house.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants