wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-08 00:38:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

moebius#119: (Windows) Security - Certificate Stores - NSSCertDBTrustDomain allows end-entities to be their own trust anchors

Browse source 
https://github.com/MoonchildProductions/moebius/pull/119
This commit is contained in:
janekptacijarabaci 2018-04-23 09:10:12 +02:00 • committed by Roy Tam
commit b9ed9af662
3 changed files with 31 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

6
security/certverifier/NSSCertDBTrustDomain.cpp
View file

@ -245,7 +245,11 @@ NSSCertDBTrustDomain::GetCertTrust(EndEntityOrCA endEntityOrCA,
// For TRUST, we only use the CERTDB_TRUSTED_CA bit, because Goanna hasn't
// needed to consider end-entity certs to be their own trust anchors since
// Goanna implemented nsICertOverrideService.
if (flags & CERTDB_TRUSTED_CA) {
// Of course, for this to work as expected, we need to make sure we're
// inquiring about the trust of a CA and not an end-entity. If an end-entity
// has the CERTDB_TRUSTED_CA bit set, Gecko does not consider it to be a
// trust anchor; it must inherit its trust.
if (flags & CERTDB_TRUSTED_CA && endEntityOrCA == EndEntityOrCA::MustBeCA) {
if (policy.IsAnyPolicy()) {
trustLevel = TrustLevel::TrustAnchor;
return Success;