Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Axeman also includes non-website certs (Code signing) and does not escape them. #12

Open
smiba opened this issue Jan 23, 2020 · 2 comments

Comments

@smiba
Copy link
Contributor

smiba commented Jan 23, 2020

Hi,

While running a custom wrapper around axeman that inserts records into a custom database format, I've found out that every now and then a special certificate comes along, example being this certificate (id 17395 on ct.googleapis.com/logs/argon2022) being a Code Signing certificate given to "SOOSAN INT CO., Ltd"

This gives multiple issues, not only does axeman not properly escape the "," character in this name but it also ends up in the all_domains field. Although the last might be wanted behaviour, the non escaped "," character isn't.

@smiba smiba changed the title Axeman also includes non-website certs (Code signing) etc. Axeman also includes non-website certs (Code signing) and does not escape them. Jan 23, 2020
smiba added a commit to smiba/Axeman that referenced this issue Jan 24, 2020
@smiba
Copy link
Contributor Author

smiba commented Jan 24, 2020

Please ignore commit, as this is meant for issue 13

smiba added a commit to smiba/Axeman that referenced this issue Jan 24, 2020
Encapsulate the fields in " characters, on the domain field escape any " characters that might appear.
@smiba
Copy link
Contributor Author

smiba commented Jan 24, 2020

Escaping fields is one thing, but still splitting domains on a space (' ') character will cause issues with code signing certs, as common name these will usually have the company name which most of the time contain spaces.

My current fix is to use a different character for splitting, but I'm not sure if this wouldn't break importing this into google or databases. Need some feedback on this

(For example, I use '|' instead of ' ', but there might be an even better character thats not allowed in the common name field?):
"\"" + '|'.join(cert_data['leaf_cert']['all_domains']).replace("\"", "\"\"") + "\"",

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant