Patch to eMudhra private key leak

README.md

@@ -1,3 +1,13 @@
+# Notice!
+
+The UXP repo for Dactyloidae is no longer regularly maintained. We will only provide important changes for the forseeable future.
+
+If you want a smooth transition, use <a href="https://repo.dactyloidae.xyz/Dactyloidae/Dactyl68">Dactyloidae 15.0 and above</a>. You're still getting Windows 2000 support, and all the perks of UXP, just in a newer and faster browser core.
+
+If you want to keep using a UXP browser, use <a href="https://basilisk-browser.org">Basilisk.</a>
+
+On XP and want to keep using UXP? Consider <a href="https://rtfreesoft.blogspot.com/">roytam1's builds.</a>
+
 <img src="browser/branding/unofficial/content/about-wordmark.svg" alt="Dactyloidae web browser" height="60">
 <br>
 <a href="https://discord.gg/ycmQAMej77">Official Discord server</a> | <a href="https://t.me/dactyloidae">Official Telegram channel</a>

security/manager/ssl/CertBlocklist.cpp

@@ -584,6 +584,35 @@ CertBlocklist::IsCertRevoked(const uint8_t* aIssuer,
     return rv;
   }
 
+  // The eMudhra intermediate CA private keys listed in
+  // https://emudhra.we-have-a-problem.com/impacted-intermediates.json are
+  // compromised. Match the public key hash independent of issuer so both
+  // direct and cross-signed certificates, including code-signing CAs, fail
+  // certificate validation.
+  static const char* const sCompromisedPubKeyHashes[] = {
+    "6+1kdcLC2A/LGZ8/6N1uazzmC3frFdTkLD3sDG9bUQU=", // EM DV TLS CA - G3B
+    "Q7/6GdbvZRRR9oQeAZkx6W9vLq7/KKtLbxzkV23icXs=", // EM OV TLS CA - G3B
+    "4CVMf83CZeLw+KQo2rt1q0rgObSHLWL17lfwh31aikE=", // EM EV TLS CA - G3B
+    "Sd01PcK5GaN3BkURfQ5gwWEV59G8JZ7v5zSwDqQ0/l8=", // EM DV TLS CA - G3C
+    "XAZgorFkkQ2P9YnBjhRVLp4Owjfc7+LLc21BpIEfgaA=", // EM EV TLS CA - G3C
+    "Y+zv7kMdSVI7wRNsTnLQIGpHcIbK9gbNXPAlaGwQnPg=", // EM OV TLS CA - G3C
+    "7E/6GtCsiAgTFLeq/+9qkfl81XKRu1umhsVBX1609rY=", // EM OV CS CA - G3B
+    "ksBj1n6PFNtx0ojhEmb/2vacvxFfe6sU87wvaNJeDjA="  // EM OV CS CA - G3C
+  };
+  nsCString encodedPubKeyHash;
+  rv = Base64Encode(hashString, encodedPubKeyHash);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+  for (size_t i = 0;
+       i < sizeof(sCompromisedPubKeyHashes) / sizeof(sCompromisedPubKeyHashes[0]);
+       ++i) {
+    if (encodedPubKeyHash.Equals(sCompromisedPubKeyHashes[i])) {
+      *_retval = true;
+      return NS_OK;
+    }
+  }
+
   CertBlocklistItem subjectPubKey(
     aSubject,
     static_cast<size_t>(aSubjectLength),