From 11570202f393f66ffcbdff79735c2d252ae5198d Mon Sep 17 00:00:00 2001
From: Halil Durak <halildrk@gmail.com>
Date: Sun, 5 Jul 2026 13:50:31 +0300
Subject: [PATCH] `Config`: ensure passed `--ca-path` paths contain hashed
 certs

---
 src/Config.zig | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/src/Config.zig b/src/Config.zig
index 8576a987d..f49b01cf5 100644
--- a/src/Config.zig
+++ b/src/Config.zig
@@ -85,6 +85,37 @@ fn logLevelValidator(_: Allocator, args: *std.process.Args.Iterator) !?log.Level
     };
 }
 
+pub fn isHashedDirectory(dir: []const u8) bool {
+    var handle = std.fs.openDirAbsolute(dir, .{ .iterate = true }) catch return false;
+    defer handle.close();
+
+    var hashed = false;
+    var it = handle.iterate();
+    while (it.next() catch return false) |entry| {
+        if (std.mem.endsWith(u8, entry.name, ".0")) {
+            hashed = true;
+            break;
+        }
+    }
+    return hashed;
+}
+
+fn caPathValidator(
+    allocator: Allocator,
+    args: *std.process.ArgIterator,
+    list: *std.ArrayList([:0]const u8),
+) !void {
+    const dir = args.next() orelse return error.MissingArgument;
+    if (!isHashedDirectory(dir)) {
+        log.fatal(.app, "invalid CA path", .{ .arg = "--ca-path", .value = dir });
+        return error.InvalidArgument;
+    }
+
+    return list.append(allocator, dir);
+}
+
+const crypto = @import("sys/libcrypto.zig");
+
 /// Common CLI args.
 const CommonOptions = .{
     .{ .name = "obey_robots", .type = bool },
@@ -119,7 +150,7 @@ const CommonOptions = .{
     .{ .name = "v8_max_heap_mb", .type = ?u32 },
     .{ .name = "watchdog_ms", .type = ?u32 },
     .{ .name = "ca_cert", .type = [:0]const u8, .multiple = true },
-    .{ .name = "ca_path", .type = [:0]const u8, .multiple = true },
+    .{ .name = "ca_path", .type = [:0]const u8, .multiple = true, .validator = caPathValidator },
     .{ .name = "disable_root_certificates", .type = bool },
 };