| fix: harden app command security handling Harden newly added app command paths and keep command-line behavior aligned with supported functionality. - restrict enc output files and SM key-store files to owner-only permissions - fail closed for explicitly configured CA files and enforce s_client host identity checks - keep TLS app mode TLS-only and require client certificates when server verification is enabled - validate SM key UUID inputs and preserve IPv4 split allocation bases during SAN parsing - apply stdin size limits, cast ctype inputs safely, and honor errdecode -hex parsing - reject unsupported GMAC/AES-WRAP/prime -safe command paths and update documentation - apply pkcs12 algorithm options and add focused SDV coverage for the fixed paths Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1422 | 1 个月前 |