Merge pull request #2609 from reaperhulk/extension-for-class-exception

don't allow UnrecognizedExtension with get_extension_for_class

2 files changed, 12 insertions, 0 deletions

diff --git a/src/cryptography/x509/extensions.py b/src/cryptography/x509/extensions.py
index 0c5b5523..f7b5d7f5 100644
--- a/src/cryptography/x509/extensions.py
+++ b/src/cryptography/x509/extensions.py
@@ -91,6 +91,13 @@ class Extensions(object):
         raise ExtensionNotFound("No {0} extension was found".format(oid), oid)
 
     def get_extension_for_class(self, extclass):
+        if extclass is UnrecognizedExtension:
+            raise TypeError(
+                "UnrecognizedExtension can't be used with "
+                "get_extension_for_class because more than one instance of the"
+                " class may be present."
+            )
+
         for ext in self:
             if isinstance(ext.value, extclass):
                 return ext
diff --git a/tests/test_x509_ext.py b/tests/test_x509_ext.py
index 7c5ca5f2..df796e0a 100644
--- a/tests/test_x509_ext.py
+++ b/tests/test_x509_ext.py
@@ -1057,6 +1057,11 @@ class TestExtensions(object):
             exts.get_extension_for_class(x509.IssuerAlternativeName)
         assert exc.value.oid == ExtensionOID.ISSUER_ALTERNATIVE_NAME
 
+    def test_unrecognized_extension_for_class(self):
+        exts = x509.Extensions([])
+        with pytest.raises(TypeError):
+            exts.get_extension_for_class(x509.UnrecognizedExtension)
+
     def test_indexing(self, backend):
         cert = _load_cert(
             os.path.join("x509", "cryptography.io.pem"),