343231 - certutil issues certs for invalid requests

Status: RESOLVED FIXED

(NSS :: Tools, defect, P2)

Description

[Nelson Bolyard (seldom reads bugmail)]

The fix for bug 174193 didn't go far enough.  
The code now checks that the request is signed, and reports a message
if the signature is invalid.  However, it then proceeds to issue the cert.
In fact, it ignores any and all errors in parsing the request.

Comment 1

[Alexei Volkov]

Attachment: return null if request has an invalid signature.

also, some code cleanup

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 247023 [details] [diff] [review]
return null if request has an invalid signature.

I have one minor issue with this patch.

>-   if (rv) {
>+   if (rv != SECSuccess) {

Everywhere in this function where rv is tested, the test is simply
     if (rv)
but here the patch changes it to
     if (rv != SECSuccess)

The two are equivalent, but I'd like to see the function remain 
self-consistent with respect to this style.  
So please change this one line back to be consistent, 
then r=nelson

Comment 3

[Alexei Volkov]

/cvsroot/mozilla/security/nss/cmd/certutil/certutil.c,v  <--  certutil.c
new revision: 1.106; previous revision: 1.105

Integrated with modification suggested by Nelson