[PATCH common 1/3] pem to der: make header and footer parsing stricter

[Thomas Ellmenreich <t.ellmenreich@proxmox.com>]

When parsing a PEM to then decode it to a DER, the header and footer
regex could previously lead to the header being included in the
decoded content as is the case with the following example:

    -----BEGIN CERTIFICATE-----TG9yZW0gaXBzdW0=
    -----END CERTIFICATE-----

Since the subroutine's focus is not to validate the structure but just to
decode the content, create a clearer error boundary by die'ing quickly if
no header or footer is found.

Additionally, there was an edgecase where the regex for the label would
glob up the whole PEM. A stricter label regex avoids globbing up the whole
PEM and can then be used to produce a more meaningful error.

Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
 src/PVE/Certificate.pm | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/PVE/Certificate.pm b/src/PVE/Certificate.pm
index 589bce8..6985d75 100644
--- a/src/PVE/Certificate.pm
+++ b/src/PVE/Certificate.pm
@@ -183,14 +183,17 @@ sub check_pem {
 sub pem_to_der {
     my ($content) = @_;
 
-    my $header = $header_re->(qr/.*?/);
-    my $footer = $footer_re->(qr/.*?/);
+    # RFC 7468 allows a single dash, so only dissallow 2 consecutive dashes
+    my $header = $header_re->(qr/(?:(?!--).)+?/);
+    my $footer = $footer_re->(qr/(?:(?!--).)+?/);
 
     $content = strip_leading_text($content);
 
     # only take first PEM entry
-    $content =~ s/^$header$//mg;
-    $content =~ s/$footer.*//sg;
+    $content =~ s/^$header$//mg
+        or die "Could not convert PEM to DER, no header found.\n";
+    $content =~ s/^$footer.*//ms
+        or die "Could not convert PEM to DER, no footer found.\n";
 
     $content = decode_base64($content);
 
-- 
2.47.3