From fcb4e04083b949c386e0629907cad7e3de8d6629 Mon Sep 17 00:00:00 2001 From: mohammed arib Date: Tue, 14 Jul 2026 11:09:31 +0530 Subject: [PATCH] match wildcard cert names against a single label only Signed-off-by: mohammed arib --- .../angus/mail/util/SocketFetcher.java | 4 +++- .../angus/mail/util/SocketFetcherTest.java | 22 +++++++++++++++++++ 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/org/eclipse/angus/mail/util/SocketFetcher.java b/core/src/main/java/org/eclipse/angus/mail/util/SocketFetcher.java index fb582aab..51bd771b 100644 --- a/core/src/main/java/org/eclipse/angus/mail/util/SocketFetcher.java +++ b/core/src/main/java/org/eclipse/angus/mail/util/SocketFetcher.java @@ -1095,8 +1095,10 @@ private static boolean matchServer(String server, String name) { int off = server.length() - tail.length(); if (off < 1) return false; - // if tail matches and is preceeded by "." + // the wildcard matches a single leftmost label only, so the + // tail must be preceeded by "." with no earlier "." in server return server.charAt(off - 1) == '.' && + server.lastIndexOf('.', off - 2) < 0 && server.regionMatches(true, off, tail, 0, tail.length()); } else { return server.equalsIgnoreCase(name); diff --git a/providers/angus-mail/src/test/java/org/eclipse/angus/mail/util/SocketFetcherTest.java b/providers/angus-mail/src/test/java/org/eclipse/angus/mail/util/SocketFetcherTest.java index cf861e3b..1bfd486b 100644 --- a/providers/angus-mail/src/test/java/org/eclipse/angus/mail/util/SocketFetcherTest.java +++ b/providers/angus-mail/src/test/java/org/eclipse/angus/mail/util/SocketFetcherTest.java @@ -66,6 +66,28 @@ public final class SocketFetcherTest { @Rule public Timeout deadlockTimeout = Timeout.seconds(20); + private static boolean matchServer(String server, String name) + throws Exception { + Class c = Class.forName( + "org.eclipse.angus.mail.util.SocketFetcher$MailHostnameVerifier"); + java.lang.reflect.Method m = + c.getDeclaredMethod("matchServer", String.class, String.class); + m.setAccessible(true); + return (Boolean) m.invoke(null, server, name); + } + + /** + * A wildcard certificate name matches a single leftmost label only. + */ + @Test + public void testWildcardMatchesSingleLabel() throws Exception { + assertTrue(matchServer("foo.example.com", "*.example.com")); + assertTrue(matchServer("FOO.EXAMPLE.COM", "*.example.com")); + assertFalse(matchServer("a.b.example.com", "*.example.com")); + assertFalse(matchServer("example.com", "*.example.com")); + assertTrue(matchServer("example.com", "example.com")); + } + /** * Test connecting with proxy host and port. */