Skip to content

fix: enforce non-root path for X.509 SVID leaf SPIFFE IDs #417

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maxlambrecht merged 2 commits into from
Mar 18, 2026
+45 −0
Merged

fix: enforce non-root path for X.509 SVID leaf SPIFFE IDs #417

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8e8dc14
fix: enforce non-root path for X.509 SVID leaf SPIFFE IDs
maxlambrecht Mar 18, 2026
4f14a47
Merge branch 'main' into fix/x509svid-leaf-spiffe-path
maxlambrecht Mar 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions java-spiffe-core/src/main/java/io/spiffe/svid/x509svid/X509Svid.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -217,6 +217,7 @@ private static X509Svid createX509Svid(final byte[] certsBytes,
final PrivateKey privateKey = generatePrivateKey(privateKeyBytes, keyFileFormat, x509Certificates);
final SpiffeId spiffeId = getSpiffeId(x509Certificates);

validateLeafSpiffeId(spiffeId);
validateLeafCertificate(x509Certificates.get(0));

// there are intermediate CA certificates
Expand All @@ -227,6 +228,13 @@ private static X509Svid createX509Svid(final byte[] certsBytes,
return new X509Svid(spiffeId, x509Certificates, privateKey, hint);
}

private static void validateLeafSpiffeId(final SpiffeId spiffeId) throws X509SvidException {
final String path = spiffeId.getPath();
if (path == null || path.isEmpty()) {
throw new X509SvidException("Leaf certificate SPIFFE ID must have a non-root path");
}
}

private static SpiffeId getSpiffeId(final List<X509Certificate> x509Certificates) throws X509SvidException {
final SpiffeId spiffeId;
try {
Expand Down
37 changes: 37 additions & 0 deletions java-spiffe-core/src/test/java/io/spiffe/svid/x509svid/X509SvidTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
package io.spiffe.svid.x509svid;

import io.spiffe.exception.InvalidSpiffeIdException;
import io.spiffe.exception.X509SvidException;
import io.spiffe.spiffeid.SpiffeId;
import io.spiffe.spiffeid.TrustDomain;
import io.spiffe.utils.CertAndKeyPair;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.Arguments;
Expand All @@ -18,8 +20,11 @@
import java.util.stream.Stream;

import static io.spiffe.utils.TestUtils.toUri;
import static io.spiffe.utils.X509CertificateTestUtils.createCertificate;
import static io.spiffe.utils.X509CertificateTestUtils.createRootCA;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.fail;

class X509SvidTest {
Expand Down Expand Up @@ -315,6 +320,38 @@ void testGetChainArray() throws URISyntaxException, X509SvidException {
assertEquals(x509Svid.getChain().get(1), x509CertificatesArray[1]);
}

@Test
void parseRaw_leafSpiffeIdWithoutPath_isRejected() throws Exception {
CertAndKeyPair rootCa = createRootCA("C = US, O = SPIFFE", "spiffe://example.org");
CertAndKeyPair leaf = createCertificate("C = US, O = SPIRE", "C = US, O = SPIFFE", "spiffe://example.org", rootCa, false);

byte[] certBytes = leaf.getCertificate().getEncoded();
byte[] keyBytes = leaf.getKeyPair().getPrivate().getEncoded();

X509SvidException exception = assertThrows(
X509SvidException.class,
() -> X509Svid.parseRaw(certBytes, keyBytes)
);

assertEquals("Leaf certificate SPIFFE ID must have a non-root path", exception.getMessage());
}

@Test
void parseRaw_leafSpiffeIdWithRootOnlyPath_isRejected() throws Exception {
CertAndKeyPair rootCa = createRootCA("C = US, O = SPIFFE", "spiffe://example.org");
CertAndKeyPair leaf = createCertificate("C = US, O = SPIRE", "C = US, O = SPIFFE", "spiffe://example.org/", rootCa, false);

byte[] certBytes = leaf.getCertificate().getEncoded();
byte[] keyBytes = leaf.getKeyPair().getPrivate().getEncoded();

InvalidSpiffeIdException exception = assertThrows(
InvalidSpiffeIdException.class,
() -> X509Svid.parseRaw(certBytes, keyBytes)
);

assertEquals("Path cannot have a trailing slash", exception.getMessage());
}

@ParameterizedTest
@MethodSource("provideX509SvidScenarios")
void parseX509Svid(TestCase testCase) {
Expand Down