Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
function findResponder(issuer, certs, raws) {
var issuerKey = issuer.tbsCertificate.subjectPublicKeyInfo;
issuerKey = ocsp.utils.toPEM(
rfc5280.SubjectPublicKeyInfo.encode(issuerKey, 'der'), 'PUBLIC KEY');
for (var i = 0; i < certs.length; i++) {
var cert = certs[i];
var signAlg = ocsp.utils.sign[cert.signatureAlgorithm.algorithm.join('.')];
if (!signAlg) {
throw new Error('Unknown signature algorithm ' +
cert.signatureAlgorithm.algorithm);
}
var verify = crypto.createVerify(signAlg);
verify.update(raws[i]);
if (!verify.verify(issuerKey, cert.signature.data))
throw new Error('Invalid signature');
var certKey = cert.tbsCertificate.subjectPublicKeyInfo;
var cert = certs[i];
var signAlg = ocsp.utils.sign[cert.signatureAlgorithm.algorithm.join('.')];
if (!signAlg) {
throw new Error('Unknown signature algorithm ' +
cert.signatureAlgorithm.algorithm);
}
var verify = crypto.createVerify(signAlg);
verify.update(raws[i]);
if (!verify.verify(issuerKey, cert.signature.data))
throw new Error('Invalid signature');
var certKey = cert.tbsCertificate.subjectPublicKeyInfo;
certKey = ocsp.utils.toPEM(
rfc5280.SubjectPublicKeyInfo.encode(certKey, 'der'), 'PUBLIC KEY');
return certKey;
}
return issuerKey;
}
function findResponder(issuer, certs, raws)
{
var issuerKey = issuer.tbsCertificate.subjectPublicKeyInfo;
issuerKey = ocsp.utils.toPEM(
rfc5280.SubjectPublicKeyInfo.encode(issuerKey, 'der'), 'PUBLIC KEY');
for (var i = 0; i < certs.length; i++)
{
var cert = certs[i];
var signAlg = ocsp.utils.sign[cert.signatureAlgorithm.algorithm.join('.')];
if (!signAlg)
{
throw new Error('Unknown signature algorithm ' +
cert.signatureAlgorithm.algorithm);
}
var verify = crypto.createVerify(signAlg);
verify.update(raws[i]);
if (!verify.verify(issuerKey, cert.signature.data))
{
const findResponder = function (issuer, certs, raws)
{
var issuerKey = issuer.tbsCertificate.subjectPublicKeyInfo;
issuerKey = ocsp.utils.toPEM(
rfc5280.SubjectPublicKeyInfo.encode(issuerKey, 'der'), 'PUBLIC KEY');
if (certs.length > 0)
{
const currentTime = Date.now();
const cert = certs[0];
const certValidity = cert.tbsCertificate.validity;
if (certValidity.notAfter.value < currentTime || certValidity.notBefore.value > currentTime)
{
return {
err: Errors.createOCSPError(
ErrorCodes.ERR_OCSP_INVALID_CERTIFICATE_VALIDITY,
"Valid from:", toUTCString(certValidity.notBefore.value),
", Valid to:", toUTCString(certValidity.notAfter.value)),
responderKey: null
}
}
const signAlg = ocsp.utils.sign[cert.signatureAlgorithm.algorithm.join('.')];
}
const verify = crypto.createVerify(signAlg);
verify.update(raws[0]);
if (!verify.verify(issuerKey, cert.signature.data))
{
return {
err: Errors.createOCSPError(ErrorCodes.ERR_OCSP_INVALID_SIGNATURE),
responderKey: null
}
}
let certKey = cert.tbsCertificate.subjectPublicKeyInfo;
certKey = ocsp.utils.toPEM(
rfc5280.SubjectPublicKeyInfo.encode(certKey, 'der'), 'PUBLIC KEY');
return {err: null, responderKey: certKey};
}
return {err: null, responderKey: issuerKey};
};
{
throw new Error('Unknown signature algorithm ' +
cert.signatureAlgorithm.algorithm);
}
var verify = crypto.createVerify(signAlg);
verify.update(raws[i]);
if (!verify.verify(issuerKey, cert.signature.data))
{
throw new Error('Invalid signature');
}
var certKey = cert.tbsCertificate.subjectPublicKeyInfo;
certKey = ocsp.utils.toPEM(
rfc5280.SubjectPublicKeyInfo.encode(certKey, 'der'), 'PUBLIC KEY');
return certKey;
}
return issuerKey;
}