Sitelet https://github.com/RustCrypto/formats/pull/2444
Skip to content

x509-cert: parse the empty string as the empty Name - #2444

Open
yuxi-liu-wired wants to merge 1 commit into
RustCrypto:masterfrom
yuxi-liu-wired:fix/name-from-str-empty
Open

yuxi-liu-wired wants to merge 1 commit into
RustCrypto:masterfrom
yuxi-liu-wired:fix/name-from-str-empty

Conversation

@yuxi-liu-wired

Copy link
Copy Markdown
Contributor

RFC 4514 Section 2.1 says: "If the RDNSequence is an empty sequence, the result is the empty or zero-length string". Display does that: Name::default().to_string() is "". Section 3's grammar makes the list of RDNs optional (distinguishedName = [ relativeDistinguishedName *( COMMA relativeDistinguishedName ) ]).

RdnSequence::from_str("") split the empty string into one empty RDN and returned an error, so the empty name couldn't be read back from its own text form:

let empty = Name::default();
assert_eq!(empty.to_string(), "");
Name::from_str(&empty.to_string()); // Err on master

Empty subject names are normal in X.509: RFC 5280 4.1.2.6 allows an empty subject when subjectAltName is present.

Fix: RdnSequence::from_str returns the empty sequence for "". A missing RDN between separators (",", "CN=a,") is still an error.

from_str_empty_name in tests/name.rs fails on master and passes with this change. The x509-cert CI steps (--no-default-features, default, --features arbitrary/hazmat/sct, the feature powerset, --all-features in debug and release, on stable and 1.85), cargo fmt --check and cargo +1.90.0 clippy --all-features --tests all pass.

Found by fuzzing the RFC 4514 Display → FromStr round trip. This PR was produced by AI agents (Claude), from the fuzzing and the fix through to this description.

RFC 4514 Section 2.1: "If the RDNSequence is an empty sequence, the
result is the empty or zero-length string", and `Display` does produce
"" for `Name::default()`. Section 3's grammar makes the RDN list
optional (`distinguishedName = [ relativeDistinguishedName ... ]`).
But `RdnSequence::from_str("")` split the empty string into one empty
RDN and failed, so the empty name could not be read back from its own
text form.

Return the empty sequence for "". A missing RDN between separators
(",", "CN=a,") is still an error.

Found by fuzzing the RFC 4514 Display -> FromStr round trip.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant