test exceptions and properly reject duplicate attributes in csrbuilder (#5319)

1 files changed, 9 insertions, 0 deletions

diff --git a/src/cryptography/x509/base.py b/src/cryptography/x509/base.py
index 43c8305bf..526fb5d6d 100644
--- a/src/cryptography/x509/base.py
+++ b/src/cryptography/x509/base.py
@@ -36,6 +36,13 @@ def _reject_duplicate_extension(extension, extensions):
             raise ValueError('This extension has already been set.')
 
 
+def _reject_duplicate_attribute(oid, attributes):
+    # This is quadratic in the number of attributes
+    for attr_oid, _ in attributes:
+        if attr_oid == oid:
+            raise ValueError('This attribute has already been set.')
+
+
 def _convert_to_naive_utc_time(time):
     """Normalizes a datetime to a naive datetime in UTC.
 
@@ -448,6 +455,8 @@ class CertificateSigningRequestBuilder(object):
         if not isinstance(value, bytes):
             raise TypeError("value must be bytes")
 
+        _reject_duplicate_attribute(oid, self._attributes)
+
         return CertificateSigningRequestBuilder(
             self._subject_name, self._extensions,
             self._attributes + [(oid, value)]