74 lines
2.2 KiB
TypeScript
74 lines
2.2 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import {
|
|
checkCertificateHostname,
|
|
inspectCryptoInput,
|
|
parsePemBlocks,
|
|
} from "../../src/crypto/inspection";
|
|
|
|
describe("crypto input inspection", () => {
|
|
it("parses bounded PEM blocks and detects encrypted key material", () => {
|
|
const pem =
|
|
"-----BEGIN ENCRYPTED PRIVATE KEY-----\nAQID\n-----END ENCRYPTED PRIVATE KEY-----";
|
|
expect(parsePemBlocks(pem)).toMatchObject([
|
|
{ label: "ENCRYPTED PRIVATE KEY", encrypted: true },
|
|
]);
|
|
expect(parsePemBlocks(pem)[0]?.bytes).toEqual(Uint8Array.of(1, 2, 3));
|
|
});
|
|
|
|
it("computes the RFC 7638 thumbprint without serialising private values", async () => {
|
|
const inspection = await inspectCryptoInput(
|
|
JSON.stringify({
|
|
kty: "RSA",
|
|
n: "AQAB",
|
|
e: "AQAB",
|
|
d: "do-not-display",
|
|
kid: "test",
|
|
}),
|
|
);
|
|
expect(inspection.items[0]?.facts["RFC 7638 SHA-256 thumbprint"]).toMatch(
|
|
/^[A-Za-z0-9_-]{43}$/u,
|
|
);
|
|
expect(JSON.stringify(inspection)).not.toContain("do-not-display");
|
|
expect(inspection.items[0]?.findings[0]?.severity).toBe("warning");
|
|
});
|
|
|
|
it("does not use a legacy common-name hostname fallback", () => {
|
|
expect(
|
|
checkCertificateHostname(
|
|
{
|
|
id: "x",
|
|
type: "X.509 certificate",
|
|
title: "x",
|
|
facts: {},
|
|
findings: [],
|
|
dnsNames: [],
|
|
},
|
|
"example.com",
|
|
),
|
|
).toEqual({ valid: false, message: "Select a certificate." });
|
|
});
|
|
|
|
it("rejects unrelated JSON", async () => {
|
|
await expect(inspectCryptoInput('{"hello":"world"}')).rejects.toThrow(
|
|
/JWK or a JWKS/u,
|
|
);
|
|
await expect(inspectCryptoInput("null")).rejects.toThrow(/PEM or JWK/u);
|
|
});
|
|
|
|
it("rejects wildcards and invalid labels as hostname inputs", () => {
|
|
const item = {
|
|
id: "x",
|
|
type: "X.509 certificate",
|
|
title: "x",
|
|
facts: {},
|
|
findings: [],
|
|
certificate: {} as never,
|
|
dnsNames: ["*.example.com"],
|
|
};
|
|
expect(checkCertificateHostname(item, "*.example.com").valid).toBe(false);
|
|
expect(checkCertificateHostname(item, "bad_label.example.com").valid).toBe(
|
|
false,
|
|
);
|
|
});
|
|
});
|