Repository navigation
fix(spiffeid): normalize trust domain case with ASCII-only lowercasing - #498
Merged
maxlambrecht merged 1 commit intoNov 5, 2026
Merged
Conversation
SpiffeId.parse and TrustDomain.parse lowercased the trust domain with
String.toLowerCase() and Character.toLowerCase(char).
String.toLowerCase() uses the JVM default locale. In a Turkish or
Azerbaijani locale 'I' becomes the dotless 'ı' (U+0131), so
TrustDomain.parse("EXAMPLE.IO") threw InvalidSpiffeIdException and
SpiffeId.parse("spiffe://INFO.ORG/service") produced the trust domain
"ınfo.org". That ID did not equal spiffe://info.org/service, matched no
bundle, and its toString() was not a valid SPIFFE ID.
Both methods also map some non-ASCII characters to ASCII letters, e.g.
the Kelvin sign U+212A to 'k' and U+0130 to 'i'. Those characters passed
the trust domain check, so "Kexample.org" was accepted as
"kexample.org", although the SPIFFE ID spec only allows ASCII letters,
digits, '.', '-' and '_' in a trust domain.
Add TrustDomain.toLowerAscii, which only maps 'A'-'Z' to 'a'-'z' and
leaves every other character unchanged, and use it in both parsers.
Mixed-case ASCII trust domains are still normalized as before. Any other
character now fails with the existing "Trust domain characters are
limited to ..." error.
Fixes spiffe#496
Signed-off-by: NopeCharon <115794254+NopeCharon@users.noreply.github.com>
maxlambrecht
force-pushed
the
fix/spiffeid-ascii-case-normalization
branch
from
November 5, 2026 20:58
d5f684c to
ae0139e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Trust domain case normalization in
SpiffeId.parseandTrustDomain.parsenow only maps ASCIIA-Ztoa-z. A new package-private helper,TrustDomain.toLowerAscii, replacesString.toLowerCase()andCharacter.toLowerCase(char). Mixed-case ASCII trust domains are normalized as before. Any other character is rejected with the existingTrust domain characters are limited to ...error.Fixes #496
Why
String.toLowerCase()uses the JVM default locale. In a Turkish or Azerbaijani localeIbecomes the dotlessı. ThenTrustDomain.parse("EXAMPLE.IO")threw, andSpiffeId.parse("spiffe://INFO.ORG/service")returned trust domainınfo.org. That ID did not equalspiffe://info.org/service, matched no bundle, and itstoString()was not a valid SPIFFE ID.Character.toLowerCaseandString.toLowerCasemap some non-ASCII characters to ASCII letters (Kelvin sign U+212A →k, U+0130 →i). Those characters passed the trust domain check, soKexample.orgwas accepted askexample.org. The SPIFFE ID spec only allows ASCII letters, digits,.,-and_.Compatibility: no public API change. The only inputs that behave differently are trust domains containing non-ASCII characters with an ASCII lowercase form, which are now rejected, and upper-case
Iundertr/azlocales, which now parses correctly.How tested
TrustDomainTest.testParseMixedCase_turkishDefaultLocale_normalizesToAsciiLowercaseandSpiffeIdTest.parseMixedCaseTrustDomain_turkishDefaultLocale_normalizesToAsciiLowercaseparse upper-case trust domains with the default locale set totr-TR, then restore the locale.TrustDomainTest.testParseNonAsciiCharWithAsciiLowercase_throwsInvalidTrustDomainandSpiffeIdTest.parseTrustDomainWithNonAsciiCharWithAsciiLowercase_throwsInvalidSpiffeIdExceptioncheck that U+212A and U+0130 are rejected, both in bare trust domain names and in SPIFFE IDs.expected: <info.org> but was: <ınfo.org>, and no exception forKexample.org../gradlew :java-spiffe-core:check :java-spiffe-core:japicmp :java-spiffe-core:javadoc :java-spiffe-provider:test :java-spiffe-helper:teston JDK 17.