parseDNSPersistRecord in va/dns_persist.go, which validates the Persistent DCV TXT Record for BR Section 3.2.2.4.22 (DNS TXT Record with Persistent Value), does not validate the parameter tag against the RFC 8659 tag grammar. It accepts a tag containing characters the grammar disallows (for example foo_bar) and ignores it as an unknown parameter.
BR Section 3.2.2.4.22 requires the record to conform to that syntax:
- The RDATA value MUST conform to the
issue-value syntax as defined in RFC 8659, Section 4.2; and
So accepting a tag that does not match the RFC 8659 tag production could be a violation.
This is the same class of violation as the CAA path, where parseCAARecord accepted invalid (empty) parameter tags. See #8977 for more details.
parseDNSPersistRecordinva/dns_persist.go, which validates the Persistent DCV TXT Record for BR Section 3.2.2.4.22 (DNS TXT Record with Persistent Value), does not validate the parameter tag against the RFC 8659taggrammar. It accepts a tag containing characters the grammar disallows (for examplefoo_bar) and ignores it as an unknown parameter.BR Section 3.2.2.4.22 requires the record to conform to that syntax:
So accepting a tag that does not match the RFC 8659
tagproduction could be a violation.This is the same class of violation as the CAA path, where
parseCAARecordaccepted invalid (empty) parameter tags. See #8977 for more details.