Aleksei Sviridkin 82c959ac4d fix(cozy-lib): anchor the CA trust-anchor guard to the whole value ...

The caCertSecret helper emits ca.crt verbatim but only checked that a
certificate block appeared SOMEWHERE in the value. Bytes before the first
block or after the last one — a human-readable preamble, or a raw DER/JWK
key that carries no PEM private-key header and so slips the key guard —
therefore passed the check and were published to the tenant inside the
trust anchor.

Anchor the certificate regex to the entire value, so it matches only one
or more complete blocks surrounded by whitespace and refuses anything
else. This mirrors the CA-extraction controller, which reaches the same
result by rebuilding the projection from the parsed blocks.

Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-07-21 17:16:48 +03:00

..

cozy-lib

fix(cozy-lib): anchor the CA trust-anchor guard to the whole value

2026-07-21 17:16:48 +03:00

Makefile

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

testfile

Remove user-facing config of limits and requests

2025-05-23 17:32:42 +03:00