[compat] reject non-Set X509 attribute values

Author: kares

src/main/java/org/jruby/ext/openssl/X509Attribute.java

@@ -189,7 +189,12 @@ public IRubyObject set_value(final ThreadContext context, final IRubyObject valu
             //if ( value instanceof ASN1.ASN1Data ) {
             //    return this.value = value;
             //}
-            return this.value = ASN1.decodeImpl(context, value);
+            final IRubyObject decoded = ASN1.decodeImpl(context, value);
+            final RubyClass setClass = _ASN1(context.runtime).getClass("Set");
+            if (!setClass.isInstance(decoded)) {
+                throw newAttributeError(context.runtime, "attribute value must be ASN1::Set: nested asn1 error");
+            }
+            return this.value = decoded;
         }
         catch (IOException e) {
             throw newIOError(context.runtime, e);
@@ -221,4 +226,9 @@ private static RaiseException newAttributeError(Ruby runtime, Exception cause) {
         return RubySupport.newError(runtime, AttributeError, cause.getMessage(), cause);
     }
 
+    private static RaiseException newAttributeError(Ruby runtime, String message) {
+        RubyClass AttributeError = _X509(runtime).getClass("AttributeError");
+        return RubySupport.newError(runtime, AttributeError, message);
+    }
+
 }// X509Attribute

test/x509/test_x509attr.rb

@@ -32,6 +32,14 @@ def test_new_with_oid_and_value
     assert_equal val.to_der, attr.value.to_der
   end
 
+  def test_new_with_non_set_value
+    error = assert_raise(OpenSSL::X509::AttributeError) do
+      OpenSSL::X509::Attribute.new("challengePassword", OpenSSL::ASN1::EndOfContent.new)
+    end
+
+    assert_equal "attribute value must be ASN1::Set: nested asn1 error", error.message
+  end
+
   def test_dup
     attr = OpenSSL::X509::Attribute.new(CHALLENGE_PASSWORD_DER)
     assert_equal attr.to_der, attr.dup.to_der