From 2c441c988df1ada3cb06d3dfddc8c4a32935c667 Mon Sep 17 00:00:00 2001
From: Nikos Rigas <37880114+NikosRig@users.noreply.github.com>
Date: Sat, 29 Mar 2025 03:00:05 +0200
Subject: [PATCH] fix: prevent crash when setting subject with unsupported
 certificate fields

Filters out unknown subject attributes (e.g., jurisdictionC) when generating fake certs with node-forge. This avoids the "Attribute type not specified" error caused by fields not recognized by node-forge.
---
 src/tls/tls-utils.ts | 39 +++++++++++++++++++++++----------------
 1 file changed, 23 insertions(+), 16 deletions(-)

diff --git a/src/tls/tls-utils.ts b/src/tls/tls-utils.ts
index 1043fd1..4941210 100644
--- a/src/tls/tls-utils.ts
+++ b/src/tls/tls-utils.ts
@@ -172,35 +172,42 @@ export class TlsUtils {
     caPair: CaPair,
     originCertificate: PeerCertificate,
   ): CaPair {
-    // const certificate = TlsUtils.covertNodeCertToForgeCert(originCertificate);
-
     const keys = forge.pki.rsa.generateKeyPair(2048);
     const cert = forge.pki.createCertificate();
     cert.publicKey = keys.publicKey;
-
+  
     cert.serialNumber = originCertificate.serialNumber;
     cert.validity.notBefore = new Date();
     cert.validity.notBefore.setFullYear(cert.validity.notBefore.getFullYear() - 1);
     cert.validity.notAfter = new Date();
     cert.validity.notAfter.setFullYear(cert.validity.notAfter.getFullYear() + 1);
-
+  
+    const supportedNames = [
+      'commonName', 'countryName', 'stateOrProvinceName',
+      'localityName', 'organizationName', 'organizationalUnitName',
+      'emailAddress',
+    ];
+  
+    const supportedShortNames = ['CN', 'C', 'ST', 'L', 'O', 'OU', 'E'];
+  
     const attrs: forge.pki.CertificateField[] = [];
-    Object.entries(originCertificate.subject).forEach(([name, value]) => {
-      attrs.push({
-        shortName: name,
-        value: value,
-      });
+    Object.entries(originCertificate.subject).forEach(([key, value]) => {
+      if (supportedNames.includes(key)) {
+        attrs.push({ name: key, value });
+      } else if (supportedShortNames.includes(key)) {
+        attrs.push({ shortName: key, value });
+      }
     });
-
+  
     cert.setSubject(attrs);
     cert.setIssuer(caPair.cert.subject.attributes);
-
-    const subjectAltNames = originCertificate.subjectaltname.split(', ').map((name) => ({
+  
+    const subjectAltNames = originCertificate.subjectaltname?.split(', ').map((name) => ({
       // 2 is DNS type
       type: 2,
       value: name.replace('DNS:', '').trim(),
-    }));
-
+    })) ?? [];
+  
     cert.setExtensions([
       {
         name: 'basicConstraints',
@@ -240,12 +247,12 @@ export class TlsUtils {
       },
     ]);
     cert.sign(caPair.key, forge.md.sha256.create());
-
+  
     return {
       key: keys.privateKey,
       cert: cert,
     };
-  }
+  }  
 
   public static isBrowserRequest(userAgent: string): boolean {
     return /mozilla/i.test(userAgent);