![Search icon](https://hackernoon.imgix.net/search-new.png?w=19&h=19)
This is your reminder: Don't forget to check strings with special characters like underscores
TL;DR: Underscore and special characters can lead to validation errors
In digital certificate validation, ensuring domain control is critical. An incomplete validation and potential security issues.
DigiCert recently encountered such a problem, where they missed adding an underscore prefix. This resulted in certificates being issued without proper validation and a cascade of broken sites with few advancement notices.
// Incorrect random value without underscore
let random_value = format!("{}", generate_random_value());
setup_dns_record(
&format!("_{}.example.com", random_value),
"dcv.digicert.com");
// Correct random value with underscore
let random_value = format!("_{}", generate_random_value());
setup_dns_record(&random_value, "dcv.digicert.com");
You can detect this smell by reviewing the validation process and checking if all required prefixes are consistently applied.
You should also store historical data and check the new rules applied to them.
AI-generated code might miss adding specific prefixes unless explicitly instructed.
This can lead to security risks if the generated code is not thoroughly reviewed.
With proper examples and instructions, AI tools can be trained to detect missing prefixes in generated or existing code.
Skipping an essential part of the validation process, like an underscore prefix, can lead to significant issues.
Ensuring such steps are consistently applied and reviewed is crucial for maintaining system integrity and security.
Relations
Disclaimer: Code Smells are my opinion.
Credits: Photo by Markus Spiske on Unsplash
Security is a process, not a product
Bruce Schneier
This article is part of the CodeSmell Series on HackerNoon: How to Find the Stinky Parts of Your Code