fix(interception): patch authorizations on import-overwrite path
The retained cert chain was applied to response metadata but the authorizations array was left unpatched, allowing a detector to compare metadata patch levels against cert attestation values and spot the divergence. Refs upstream JingMatrix #164.
This commit is contained in:
+5
@@ -332,6 +332,11 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
|
||||
}
|
||||
SystemLogger.info("[TX_ID: $txId] Imported key overwrote attested alias, serving retained chain for $keyId")
|
||||
CertificateHelper.updateCertificateChain(response.metadata, retainedChain).getOrThrow()
|
||||
response.metadata.authorizations =
|
||||
InterceptorUtils.patchAuthorizations(
|
||||
response.metadata.authorizations,
|
||||
callingUid,
|
||||
)
|
||||
return InterceptorUtils.createTypedObjectReply(response)
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user