Description
Symfony version(s) affected: 4.2.11
Description
The following ssl subject is parsed wrongly:
emailAddress=firstname.lastname@mycompany.co.uk,CN=Firstname.Lastname,OU=london,OU=company design and engineering,OU=Issuer London,OU=Roaming,OU=Interactive,OU=Users,OU=Standard,OU=Business,DC=england,DC=core,DC=company,DC=co,DC=uk
How to reproduce
Create a certificate with a dot in the CN field and use this as the client certificate.
In the above example the $user field is set to firstname.lastname@mycompany.co.uk,CN=Firstname.Lastname
when it should be set to firstname.lastname@mycompany.co.uk
Possible Solution
Replace the regex #emailAddress=(.+\@.+\.[^,/]+)($|,|/)#
with a better regex.
This one is working for us but other solutions are also possible:
#emailAddress=([^@]+\@(?:(?:[\d\p{L}][-\d\p{L}]*[\d\p{L}]*)(\.(?:[\d\p{L}][-\d\p{L}]*[\d\p{L}]*))*))#
This matches the email address as 'any sequence of characters not including @ followed by an @ followed by a domain name'. In this regex a domain name is 'any sequence of domain name components separated by a dot' and a domain name component is 'any sequence of letters numbers and dashes not starting or ending with a dash and without two dashes next to each other' where a letter is a unicode letter.