verify_ocsp_response() assumes OCSP response has reason
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 115
- Forks
- 34
- PR merge metrics
- No merged PRs in 30d
Description
When performing OCSP revocation checks against https://revoked.badssl.com/ using the function certvalidator.validate.verify_ocsp_response() I get the following:
Traceback (most recent call last):
...
File "/.../venv/lib/python3.6/site-packages/certvalidator/validate.py", line 1101, in verify_ocsp_response
reason = revocation_info['revocation_reason'].human_friendly
AttributeError: 'Void' object has no attribute 'human_friendly'
It seems that the function assumes that a revocation reason is given, whereas the RFC states (end of https://tools.ietf.org/html/rfc6960#section-4.2.1) that revocation reason is optional (revocationReason [0] EXPLICIT CRLReason OPTIONAL), and hence revocation_info['revocation_reason'] can be an instance of Void. I would therefore suggest that verify_ocsp_response() should check whether revocation_info['revocation_reason'] is Void first before trying get the human_friendly property, or that Void should have a human_friendly property.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in certvalidator/validate.py at verify_ocsp_response(), especially the revocation_reason handling around line 1101. Reproduce the failure against https://revoked.badssl.com/ and inspect how an absent reason is represented. Done means the optional OCSP revocation reason no longer causes an AttributeError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 38/100