Conversation
1. tls-cert-health: self-signed cert detection missed most real-world certs because it required cert.IsCA==true before checking the signature. Plain openssl/nginx self-signed leaf certs set IsCA=false. Fix: compare Issuer and Subject DNs — equality means self-issued. 2. http-cors-wildcard: when an origin is reflected (not *), the finding omitted the Access-Control-Allow-Credentials detail because IsCORSWildcard only sets credentialed when acao==*. Fix: check the header independently in the reflected branch. 3. version-ladder (mcp): a server responding HTTP 405 or 501 without the word "version" in the body stopped the negotiation ladder instead of trying the next protocol revision. Fix: continue on 405/501 unconditionally before the existing body-text heuristic.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three bugs fixed in one PR
1.
tls-cert-health: self-signed cert detection missed most real-world certsThe check was gated on
cert.IsCA == true, but the Basic Constraints CA flag is only set when the cert is a CA cert. Plain self-signed leaf certs generated withopenssl req -x509or nginx haveIsCA = false, so the check silently passed them.Fix: Compare
Issuer.String() == Subject.String()— a cert that signed itself has identical issuer and subject DNs.2.
http-cors-wildcard: credentials detail dropped when origin is reflectedIsCORSWildcardonly setscredentialed = truewhenAccess-Control-Allow-Originis literally"*". When the origin is reflected instead,credentialedstays false even if the server also sendsAccess-Control-Allow-Credentials: true— so the finding description omitted that detail entirely.Fix: In the reflected-origin branch, check the
Access-Control-Allow-Credentialsheader independently and append the detail to the description.3. Version negotiation ladder stops on
405/501without "version" in bodyisVersionRejectionrequires the word"version"somewhere in the response body before it continues to the next rung. A server returning405 Method Not Allowedor501 Not Implementedwith a plain error body (e.g."Method Not Allowed") aborted the ladder instead of trying the next protocol version.Fix: Continue on
405/501unconditionally, before the body-text heuristic. The ladder is only 3 entries deep so the extra retries are negligible.