Skip to content

security-http: X509AuthenticationListener parses subject wrongly #33636

@jcable

Description

@jcable

Symfony version(s) affected: 4.2.11

Description
The following ssl subject is parsed wrongly:
emailAddress=firstname.lastname@mycompany.co.uk,CN=Firstname.Lastname,OU=london,OU=company design and engineering,OU=Issuer London,OU=Roaming,OU=Interactive,OU=Users,OU=Standard,OU=Business,DC=england,DC=core,DC=company,DC=co,DC=uk

How to reproduce
Create a certificate with a dot in the CN field and use this as the client certificate.
In the above example the $user field is set to firstname.lastname@mycompany.co.uk,CN=Firstname.Lastname when it should be set to firstname.lastname@mycompany.co.uk

Possible Solution
Replace the regex #emailAddress=(.+\@.+\.[^,/]+)($|,|/)# with a better regex.
This one is working for us but other solutions are also possible:
#emailAddress=([^@]+\@(?:(?:[\d\p{L}][-\d\p{L}]*[\d\p{L}]*)(\.(?:[\d\p{L}][-\d\p{L}]*[\d\p{L}]*))*))#

This matches the email address as 'any sequence of characters not including @ followed by an @ followed by a domain name'. In this regex a domain name is 'any sequence of domain name components separated by a dot' and a domain name component is 'any sequence of letters numbers and dashes not starting or ending with a dash and without two dashes next to each other' where a letter is a unicode letter.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      pFad - Phonifier reborn

      Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

      Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


      Alternative Proxies:

      Alternative Proxy

      pFad Proxy

      pFad v3 Proxy

      pFad v4 Proxy