fix(libkernel): filter host CA bundle to certificate blocks

core/libs/prx/libkernel/File/src/SandboxCertificates.cpp

@@ -8,6 +8,7 @@
 #include <optional>
 #include <stdexcept>
 #include <string>
+#include <string_view>
 #include <system_error>
 
 #ifdef _WIN32
@@ -24,6 +25,34 @@ extern "C" const char* APS5_VABI sceKernelGetFsSandboxRandomWord();
 
 namespace {
 constexpr char CertificateBegin[] = "-----BEGIN CERTIFICATE-----";
+constexpr char CertificateEnd[] = "-----END CERTIFICATE-----";
+
+std::string CertificateBlocksOnly(const std::string& bundle) {
+    const std::string_view begin(CertificateBegin);
+    const std::string_view end(CertificateEnd);
+    std::string certificates;
+    std::size_t certificateStart = 0;
+    bool inCertificate = false;
+    for (std::size_t lineStart = 0; lineStart < bundle.size();) {
+        const auto newline = bundle.find('\n', lineStart);
+        const auto lineEnd = newline == std::string::npos ? bundle.size() : newline;
+        auto line = std::string_view(bundle).substr(lineStart, lineEnd - lineStart);
+        if (!line.empty() && line.back() == '\r') line.remove_suffix(1);
+
+        if (line == begin) {
+            certificateStart = lineStart;
+            inCertificate = true;
+        } else if (line == end && inCertificate) {
+            const auto blockEnd = newline == std::string::npos ? lineEnd : newline + 1;
+            certificates.append(bundle, certificateStart, blockEnd - certificateStart);
+            inCertificate = false;
+        }
+
+        if (newline == std::string::npos) break;
+        lineStart = newline + 1;
+    }
+    return certificates;
+}
 
 std::optional<std::string> ReadFile(const std::filesystem::path& path) {
     std::ifstream file(path, std::ios::binary);
@@ -55,8 +84,8 @@ unsigned long ProcessId() { return static_cast<unsigned long>(getpid()); }
 #endif
 
 std::filesystem::path WriteCertificateList(const std::filesystem::path& root) {
-    const auto bundle = HostCertificates();
-    if (bundle.find(CertificateBegin) == std::string::npos) return {};
+    const auto bundle = CertificateBlocksOnly(HostCertificates());
+    if (bundle.empty()) return {};
     const auto directory = root / "cert_cache";
     std::filesystem::create_directories(directory);
     const auto target = directory / "CA_LIST.cer";

core/libs/tests/GuestSandboxCertificates.cpp

@@ -73,8 +73,13 @@ static void CheckOverrides(const std::string& directory, const std::string& path
 int main() {
 #ifndef _WIN32
     const auto bundle = std::filesystem::absolute("host_bundle.pem");
-    const std::string expected = "-----BEGIN CERTIFICATE-----\nMIIBAA==\n-----END CERTIFICATE-----\n";
-    { std::ofstream file(bundle, std::ios::binary | std::ios::trunc); file << expected; }
+    const std::string expected = "-----BEGIN CERTIFICATE-----\nMIIBAA==\n-----END CERTIFICATE-----\n"
+                                 "-----BEGIN CERTIFICATE-----\r\nMIIBAg==\r\n-----END CERTIFICATE-----\r\n";
+    const std::string input = "Bag Attributes\r\n    friendlyName: should-not-be-copied\r\n"
+                              "-----BEGIN PRIVATE KEY-----\r\nprivate-key-material\r\n-----END PRIVATE KEY-----\r\n" +
+                              expected + "subject=should-not-be-copied\r\n"
+                              "-----BEGIN RSA PRIVATE KEY-----\r\nmore-private-key-material\r\n-----END RSA PRIVATE KEY-----\r\n";
+    { std::ofstream file(bundle, std::ios::binary | std::ios::trunc); file << input; }
     Require(setenv("SSL_CERT_FILE", bundle.c_str(), 1) == 0);
 #endif
     const std::string directory = std::string("/") + sceKernelGetFsSandboxRandomWord() + "/common/cert";