fix: Critical error on missing/invalid extensions

italia · Nov 12, 2021 · 27a7c2d · 27a7c2d
1 parent 239f726
commit 27a7c2d
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 16 deletions.
diff --git a/spid_compliant_certificates/__init__.py b/spid_compliant_certificates/__init__.py
@@ -25,7 +25,7 @@
 _maj = 0
 
 # minor version
-_min = 2
+_min = 3
 
 # micro version
 _mic = 0

diff --git a/spid_compliant_certificates/validator/checks/basic_constraints.py b/spid_compliant_certificates/validator/checks/basic_constraints.py
@@ -28,7 +28,6 @@
 
 def basic_constraints(extensions: x509.Extensions) -> List[Tuple[bool, str, Any]]:  # noqa
     checks = []
-
     # basicConstraints: CA:FALSE
     ext_cls = x509.BasicConstraints
     ext_name = ext_cls.oid._name
@@ -46,5 +45,8 @@ def basic_constraints(extensions: x509.Extensions) -> List[Tuple[bool, str, Any]
     except x509.ExtensionNotFound:
         msg = f'{ext_name} must be present'
         checks.append((FAILURE, msg, None))
+    except ValueError:
+        msg = f'{ext_name} must be present'
+        checks.append((FAILURE, msg, None))
 
     return checks
diff --git a/spid_compliant_certificates/validator/validate.py b/spid_compliant_certificates/validator/validate.py
@@ -64,21 +64,28 @@ def validate(crt_file: str, sector: str) -> Report:
     ))
 
     # check basicConstraints
-    rep.add_test(_do_check(
-        checks.basic_constraints(crt.extensions),
-        'Checking basicConstraints x509 extension'
-    ))
+    _ext_msg = 'Checking basicConstraints x509 extension'
+    try:
+        rep.add_test(_do_check(
+            checks.basic_constraints(crt.extensions),
+            _ext_msg
+        ))
 
-    # check keyUsage
-    rep.add_test(_do_check(
-        checks.key_usage(crt.extensions),
-        'Checking keyUsage x509 extension'
-    ))
+        # check keyUsage
+        rep.add_test(_do_check(
+            checks.key_usage(crt.extensions),
+            'Checking keyUsage x509 extension'
+        ))
 
-    # check certificatePolicies
-    rep.add_test(_do_check(
-        checks.certificate_policies(crt.extensions, sector),
-        'Checking certificatePolicies x509 extension'
-    ))
+        # check certificatePolicies
+        rep.add_test(_do_check(
+            checks.certificate_policies(crt.extensions, sector),
+            'Checking certificatePolicies x509 extension'
+        ))
+
+    except ValueError as e:
+        test = Test(f"Critical Error on parsing extensions: {e}")
+        test.add_check(Check(f"{_ext_msg} critical error", 'failure', False))
+        rep.add_test(test)
 
     return rep