fix: reject non-canonical cert booleans - #76

Open

leopoldjoy wants to merge 1 commit into

mainfrom

audit/reject-noncanonical-booleans

leopoldjoy commented Jul 27, 2026

Contributor

Summary

reject non-canonical DER BOOLEAN bytes for extension critical flags
reject non-canonical DER BOOLEAN bytes for BasicConstraints cA
add focused parser regression tests for Finding Move CA bundle validation into NitroValidator contract #13

Verification

forge test --match-contract CertManagerTest
forge build --sizes (compile succeeds; raw size command still fails on oversized test harnesses, addressed by prerequisite ci: scope size check to deployables #73; deployable CertManager margin is 31 bytes)


          fix: reject non-canonical cert booleans

0def68e

Co-authored-by: OpenCode <opencode-noreply@coinbase.com>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet