Skip to content

crypto/x509: unexpected handling of escape characters #73028

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
onepeople158 opened this issue Mar 25, 2025 · 6 comments
Closed

crypto/x509: unexpected handling of escape characters #73028

onepeople158 opened this issue Mar 25, 2025 · 6 comments
Labels
BugReport Issues describing a possible bug in the Go implementation. NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.

Comments

@onepeople158
Copy link

onepeople158 commented Mar 25, 2025

Go version

go version go1.24.1 linux/amd64

Output of go env in your module/workspace:

CN=test,OU=Class 3 Public Primary Certification Authority,O=VeriSign\\,L=test,ST=test,C=US
2025-01-01 00:00:00 +0000 UTC
2025-12-01 00:00:00 +0000 UTC
1

What did you do?

Hello Developer: I have a CRL file, and the "O" field in its issuer section contains an escape character. The value of the "O" field is 'VeriSign\'. When I use Go to parse this CRL file, Go interprets the "O" field as 'VeriSign\\'. However, when I open the CRL file as a .crl file, the "O" field in the issuer section shows as 'VeriSign\'. Therefore, I suspect that the handling of the escape character '\\' by Go may not be entirely reasonable.

What did you see happen?

The issuer field is parsed as Issuer: CN=test,OU=Class 3 Public Primary Certification Authority,O=VeriSign\\,L=test,ST=test,C=US
.

What did you expect to see?

crl_file_.zip

@gabyhelp gabyhelp added the BugReport Issues describing a possible bug in the Go implementation. label Mar 25, 2025
@dmitshur dmitshur changed the title crypto/X509: Go handling of escape characters crypto/x509: unexpected handling of escape characters Mar 25, 2025
@dmitshur
Copy link
Contributor

In the issue report you mention "I use Go to parse this CRL file, Go interprets". Can you please provide a snippet of code for that? In particular, that code will help determine if the problem is in the crypto/x509 package, or how it's being used.

Please see https://go.dev/wiki/Questions for asking questions about Go.

@dmitshur dmitshur added the WaitingForInfo Issue is not actionable because of missing required information, which needs to be provided. label Mar 25, 2025
@onepeople158
Copy link
Author

In the issue report you mention "I use Go to parse this CRL file, Go interprets". Can you please provide a snippet of code for that? In particular, that code will help determine if the problem is in the crypto/x509 package, or how it's being used.

Please see https://go.dev/wiki/Questions for asking questions about Go.

package main

import (
    "crypto/x509"
    "encoding/asn1"
    "fmt"
    "io/ioutil"
    "os"
    "math/big"
)

func main() {

    derBytes, err := ioutil.ReadFile("crl_file_.der")
    if err != nil {
        fmt.Println(err)
        os.Exit(1)
    }

    crl, err := x509.ParseRevocationList(derBytes)
    if err != nil {
        fmt.Println(err)
        os.Exit(1)
    }
    fmt.Printf("%s\n",crl.Issuer)
    fmt.Printf("%s\n",crl.ThisUpdate)
    fmt.Printf("%s\n", crl.NextUpdate)
    fmt.Printf("%d\n", len(crl.RevokedCertificates))
}

@dmitshur
Copy link
Contributor

Thanks. The value of crl.Issuer.Organization contains only one backslash character:

Organization:[]string{`VeriSign\`}

And the String method prints that one backslash in escaped format. Here's a smaller repro:

package main

import (
	"crypto/x509/pkix"
	"fmt"
)

func main() {
	name := pkix.Name{Organization: []string{`abc\`}}
	fmt.Println(name)

	// Output: O=abc\\
}

(https://go.dev/play/p/TULVLleyOCY)

CC @golang/security.

@dmitshur dmitshur added NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. and removed WaitingForInfo Issue is not actionable because of missing required information, which needs to be provided. labels Mar 26, 2025
@onepeople158
Copy link
Author

Thanks. The value of contains only one backslash character:crl.Issuer.Organization

Organization:[]string{`VeriSign\`}

And the String method prints that one backslash in escaped format. Here's a smaller repro:

package main

import (
"crypto/x509/pkix"
"fmt"
)

func main() {
name := pkix.Name{Organization: []string{abc\}}
fmt.Println(name)

// Output: O=abc\
}
(https://go.dev/play/p/TULVLleyOCY)

CC @golang/security.
Hello, developer. Do you mean that it is normal for the Name parsed by Go to appear in its raw string format?

@seankhliao
Copy link
Member

see https://www.rfc-editor.org/rfc/rfc2253#section-2.4

I believe this this working as intended.

@seankhliao seankhliao closed this as not planned Won't fix, can't repro, duplicate, stale Mar 27, 2025
@onepeople158
Copy link
Author

see https://www.rfc-editor.org/rfc/rfc2253#section-2.4

I believe this this working as intended.

Thank you for your reply.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
BugReport Issues describing a possible bug in the Go implementation. NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Development

No branches or pull requests

4 participants