Apply policy constraints handling for the preparation step.

@param ValidatorState $state
@param Certificate $cert
@return ValidatorState
9996
private function _preparePolicyConstraints(ValidatorState $state,
        Certificate $cert): ValidatorState
    {
        $extensions = $cert->tbsCertificate()->extensions();
        if (!$extensions->hasPolicyConstraints()) {
            return $state;
        }
        $ext = $extensions->policyConstraints();
        // (i.1)
        if ($ext->hasRequireExplicitPolicy() &&
             $ext->requireExplicitPolicy() < $state->explicitPolicy()) {
            $state = $state->withExplicitPolicy($ext->requireExplicitPolicy());
        }
        // (i.2)
        if ($ext->hasInhibitPolicyMapping() &&
             $ext->inhibitPolicyMapping() < $state->policyMapping()) {
            $state = $state->withPolicyMapping($ext->inhibitPolicyMapping());
        }
        return $state;
    }
700967
@Override
    public void check(Certificate cert, Collection<String> unresCritExts)
        throws CertPathValidatorException
    {
        X509Certificate currCert = (X509Certificate)cert;

        remainingCerts--;

        // if final certificate, check that target constraints are satisfied
        if (remainingCerts == 0) {
            if (targetConstraints != null &&
                targetConstraints.match(currCert) == false) {
                throw new CertPathValidatorException("target certificate " +
                    "constraints check failed");
            }
        } else {
            // otherwise, verify that keyCertSign bit is set in CA certificate
            verifyCAKeyUsage(currCert);
        }

        // remove the extensions that we have checked
        if (unresCritExts != null && !unresCritExts.isEmpty()) {
            unresCritExts.remove(KeyUsage_Id.toString());
            unresCritExts.remove(ExtendedKeyUsage_Id.toString());
            unresCritExts.remove(SubjectAlternativeName_Id.toString());
        }
    }
1110352
protected function _deleteMappings(Certificate $cert, ValidatorState $state)
    {
        $idps = $cert->tbsCertificate()
            ->extensions()
            ->policyMappings()
            ->issuerDomainPolicies();
        // delete each node of depth i in the valid_policy_tree
        // where ID-P is the valid_policy
        foreach ($this->_nodesAtDepth($state->index()) as $node) {
            if (in_array($node->validPolicy(), $idps)) {
                $node->remove();
            }
        }
        $this->_pruneTree($state->index() - 1);
    }
914093
public function setState($state)
    {
        if (!isset($this->_states[$state])) {
            include_once 'Zend/Search/Exception.php';
            throw new Zend_Search_Exception('State \'' . $state . '\' is not on of the possible FSM states.');
        }

        $this->_currentState = $state;
    }
1148895
private function _prepareNameConstraints(ValidatorState $state,
        Certificate $cert): ValidatorState
    {
        $extensions = $cert->tbsCertificate()->extensions();
        if ($extensions->hasNameConstraints()) {
            $state = $this->_processNameConstraints($state, $cert);
        }
        return $state;
    }
1225640
private function verifyState($state)
    {
        $this->logger->debug('Verify parameter state.');
        $state = urldecode($state);
        $stateArray = [];
        parse_str($state, $stateArray);
        $token = $stateArray['token'];
        $token = preg_replace('~{~', '', $token, 1);
        $token = preg_replace('~}~', '', $token, 1);
        
        if ($token != $this->session->get(static::OPENID_SESSION_TOKEN)) {
            $this->logger->error('The value of the parameter STATE is not equal to the one which is expected');
            throw new SecurityException("The token is invalid.");
        }
    }
915789
private function _verifySignature(ValidatorState $state, Certificate $cert)
    {
        try {
            $valid = $cert->verify($state->workingPublicKey(), $this->_crypto);
        } catch (\RuntimeException $e) {
            throw new PathValidationException(
                "Failed to verify signature: " . $e->getMessage(), 0, $e);
        }
        if (!$valid) {
            throw new PathValidationException(
                "Certificate signature doesn't match.");
        }
    }
821883
function validateCert(cert, cb)
{
  // if we already have an entry in the cache, use it
  var ocspResponse = getOcspResponseCache().get(cert);
  if (ocspResponse)
  {
    process.nextTick(function()
    {
      Logger.getInstance().trace('Returning OCSP status for certificate %s ' +
          'from cache', cert.serialNumber);

      cb(null, ocspResponse);
    });
  }
  else
  {
    try
    {
      var decoded = CertUtil.decode(cert);
    }
    catch(e)
    {
      process.nextTick(function()
      {
        cb(e);
      });
    }

    // issue a request to get the ocsp status
    check(decoded, cb);
  }
}
868180
protected function _setState($state)
    {
        if ($state !== null && !($state instanceof MapInterface)) {
            throw $this->_createInvalidArgumentException(
                $this->__('Argument is not a valid map'), null, null, $state
            );
        }

        $this->state = $state;
    }
1254865
public function storeAuthorizationState($service, $state)
    {
        $service = $this->normalizeServiceName($service);

        $states = $this->sessionScope->get(self::SESSION_STATE);
        $states[$service] = $state;
        $this->sessionScope->set(self::SESSION_STATE, $states);

        return $this;
    }
794040
public function setState($state)
    {
        $oldState = $this->getState()->getUri();
        if ($oldState == $state) {
            common_Logger::w('Delivery execution ' . $this->getIdentifier() . ' already in state ' . $state);
            return false;
        }
        $this->setData(OntologyDeliveryExecution::PROPERTY_STATUS, $state);
        if ($state == DeliveryExecutionInterface::STATE_FINISHED) {
            $this->setData(OntologyDeliveryExecution::PROPERTY_TIME_END, microtime());
        }
        return $this->service->updateDeliveryExecutionStatus($this, $oldState, $state);
    }
329851
private StateData validateState(HttpSession session, String state) throws Exception {
        if (StringUtils.isNotEmpty(state)) {
            StateData stateDataInSession = removeStateFromSession(session, state);
            if (stateDataInSession != null) {
                return stateDataInSession;
            }
        }
        throw new Exception(FAILED_TO_VALIDATE_MESSAGE + "could not validate state");
    }
1035360
private function _wrapUp(ValidatorState $state, Certificate $cert): ValidatorState
    {
        $tbs_cert = $cert->tbsCertificate();
        $extensions = $tbs_cert->extensions();
        // (a)
        if ($state->explicitPolicy() > 0) {
            $state = $state->withExplicitPolicy($state->explicitPolicy() - 1);
        }
        // (b)
        if ($extensions->hasPolicyConstraints()) {
            $ext = $extensions->policyConstraints();
            if ($ext->hasRequireExplicitPolicy() &&
                 $ext->requireExplicitPolicy() == 0) {
                $state = $state->withExplicitPolicy(0);
            }
        }
        // (c)(d)(e)
        $state = $this->_setPublicKeyState($state, $cert);
        // (f) process relevant extensions
        $state = $this->_processExtensions($state, $cert);
        // (g) intersection of valid_policy_tree and the initial-policy-set
        $state = $this->_calculatePolicyIntersection($state);
        // check that explicit_policy > 0 or valid_policy_tree is set
        if (!($state->explicitPolicy() > 0 || $state->hasValidPolicyTree())) {
            throw new PathValidationException("No valid policies.");
        }
        // path validation succeeded
        return $state;
    }
347624
public function onInvalid(IState $state = null)
    {
        return $state->isImplementsInterface(IStatePreventable::class)
            ? $state->getOnTerminate()
            : false;
    }
283942
protected function _setState($state)
    {
        if ($state !== null && !is_string($state) && !($state instanceof Stringable)) {
            throw $this->_createInvalidArgumentException(
                $this->__('Argument is not a valid state'),
                null,
                null,
                $state
            );
        }

        $this->state = $state;
    }
649899
public function setState($state)
    {
        if (!in_array($state, $this->validStates)) {
            throw new InvalidArgumentException("Invalid editor state: $state");
        }

        $this->state = $state;

        $this->session->put($this->statePersistenceKey, $state);

        return $this;
    }
717064
public function skipToken(&$state)
    {
        $pos = $state->pos;
        $rules = $this->ruler->getRules('');
        $maxNesting = $state->md->options->maxNesting;
        $cache = &$state->cache;
        $ok = false;

        if ( isset($cache[$pos])) {
            $state->pos = $cache[$pos];
            return;
        }

        if ($state->level < $maxNesting) {
            foreach ($rules as &$rule) {
                // Increment state.level and decrement it later to limit recursion.
                // It's harmless to do here, because no tokens are created. But ideally,
                // we'd need a separate private state variable for this purpose.
                //
                $state->level++;

                if( is_array($rule) )
                    $ok = $rule[0]->{$rule[1]}($state, true);
                else
                    $ok = $rule($state, true);

                $state->level--;

                if ($ok) break;
            }
        } else {
            // Too much nesting, just skip until the end of the paragraph.
            //
            // NOTE: this will cause links to behave incorrectly in the following case,
            //       when an amount of `[` is exactly equal to `maxNesting + 1`:
            //
            //       [[[[[[[[[[[[[[[[[[[[[foo]()
            //
            // TODO: remove this workaround when CM standard will allow nested links
            //       (we can replace it by preventing links from being parsed in
            //       validation mode)
            //
            $state->pos = $state->posMax;
        }

        if (!$ok) { $state->pos++; }
        $cache[$pos] = $state->pos;
    }