romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-31 11:38:06 +03:00
Code Issues Projects Releases Packages Wiki Activity

tests: fix cert comparison with old cryptography

Browse source 
The fallback path for cryptography < 42 was broken by commit e13362c2
that caused a comparison between offset-naive and offset-aware
datetimes. Use the positional form of tz in datetime.now() everywhere.

Ref: #22396

Pointed out by Codex Security
Closes #22426
This commit is contained in:
Dan Fandrich 2026-07-28 16:27:38 -07:00
parent c4fe0c7b9f
commit 9743720ab9
2 changed files with 10 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/http/scorecard.py
View file

@ -693,7 +693,7 @@ class ScoreRunner:
'os': self.env.curl_os(),
'server': self.server_descr,
'samples': nsamples,
'date': f'{datetime.datetime.now(tz=datetime.timezone.utc).isoformat()}',
'date': f'{datetime.datetime.now(datetime.timezone.utc).isoformat()}',
}
}
if self._limit_rate:

20
tests/http/testenv/certs.py
View file

@ -344,17 +344,15 @@ class CertStore:
cert = self.load_pem_cert(cert_file)
pkey = self.load_pem_pkey(pkey_file)
try:
now = datetime.now(tz=timezone.utc)
if check_valid and \
((cert.not_valid_after_utc < now) or
(cert.not_valid_before_utc > now)):
return None
except AttributeError: # older python
now = datetime.now(timezone.utc)
if check_valid and \
((cert.not_valid_after < now) or
(cert.not_valid_before > now)):
return None
before = cert.not_valid_before_utc
after = cert.not_valid_after_utc
except AttributeError: # cryptography < 42.0.0
# the timestamps are already returned in UTC, just missing the time zone
before = cert.not_valid_before.replace(tzinfo=timezone.utc)
after = cert.not_valid_after.replace(tzinfo=timezone.utc)
now = datetime.now(timezone.utc)
if check_valid and ((after < now) or (before > now)):
return None
creds = Credentials(name=name, cert=cert, pkey=pkey, issuer=issuer)
creds.set_store(self)
creds.set_files(cert_file, pkey_file, comb_file)