Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2025-02-28 19:32:59 +00:00
Code Issues Projects Releases Packages Wiki Activity

[RAPPS] Check Let's Encrypt issuer prefix (#7650)

Browse source
This commit is contained in:
Whindmar Saksit 2025-01-21 13:06:55 +01:00 committed by GitHub
parent 690643fc77
commit c8b2c4c94d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 16 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
base/applications/rapps/loaddlg.cpp
View file

@ -52,10 +52,23 @@
#include "unattended.h" #include "unattended.h"
#ifdef USE_CERT_PINNING #ifdef USE_CERT_PINNING
#define CERT_ISSUER_INFO_PREFIX "US\r\nLet's Encrypt\r\nR"
#define CERT_ISSUER_INFO_OLD "US\r\nLet's Encrypt\r\nR3" #define CERT_ISSUER_INFO_OLD "US\r\nLet's Encrypt\r\nR3"
#define CERT_ISSUER_INFO_NEW "US\r\nLet's Encrypt\r\nR11" #define CERT_ISSUER_INFO_NEW "US\r\nLet's Encrypt\r\nR11"
#define CERT_SUBJECT_INFO "rapps.reactos.org" #define CERT_SUBJECT_INFO "rapps.reactos.org"
static bool
IsTrustedPinnedCert(LPCSTR Subject, LPCSTR Issuer)
{
if (strcmp(Subject, CERT_SUBJECT_INFO))
return false;
#ifdef CERT_ISSUER_INFO_PREFIX
return Issuer == StrStrA(Issuer, CERT_ISSUER_INFO_PREFIX);
#else
return !strcmp(Issuer, CERT_ISSUER_INFO_OLD) || !strcmp(Issuer, CERT_ISSUER_INFO_NEW);
#endif #endif
}
#endif // USE_CERT_PINNING
enum DownloadType enum DownloadType
{ {
@ -917,14 +930,10 @@ CDownloadManager::ThreadFunc(LPVOID param)
szMsgText.LoadStringW(IDS_UNABLE_TO_QUERY_CERT); szMsgText.LoadStringW(IDS_UNABLE_TO_QUERY_CERT);
bAskQuestion = true; bAskQuestion = true;
} }
else else if (!IsTrustedPinnedCert(subjectName, issuerName))
{ {
if (strcmp(subjectName, CERT_SUBJECT_INFO) || szMsgText.Format(IDS_MISMATCH_CERT_INFO, (LPCSTR)subjectName, (LPCSTR)issuerName);
(strcmp(issuerName, CERT_ISSUER_INFO_OLD) && strcmp(issuerName, CERT_ISSUER_INFO_NEW))) bAskQuestion = true;
{
szMsgText.Format(IDS_MISMATCH_CERT_INFO, (char *)subjectName, (const char *)issuerName);
bAskQuestion = true;
}
} }
if (bAskQuestion) if (bAskQuestion)