diff options
author | Jeremy Kemper <jeremy@bitsweat.net> | 2013-12-06 08:08:28 -0800 |
---|---|---|
committer | Jeremy Kemper <jeremy@bitsweat.net> | 2013-12-06 08:08:28 -0800 |
commit | 8ef1ef1b822cdb49e72edd16a8ddbc67e5e1cf94 (patch) | |
tree | 73aa3c9b3725c4ecd022a1a70766aaace8261a8e /activesupport | |
parent | 747c616aa78ebc0fecc01123c6b9623f970d26bb (diff) | |
parent | a4e1e5d6329f31cb5a1ee7561fdf05dd5559ef7c (diff) | |
download | rails-8ef1ef1b822cdb49e72edd16a8ddbc67e5e1cf94.tar.gz rails-8ef1ef1b822cdb49e72edd16a8ddbc67e5e1cf94.tar.bz2 rails-8ef1ef1b822cdb49e72edd16a8ddbc67e5e1cf94.zip |
Merge pull request #10635 from vipulnsward/change_to_strict
Use `Base.strict_decode64` instead of `Base.decode64`
Diffstat (limited to 'activesupport')
-rw-r--r-- | activesupport/lib/active_support/message_encryptor.rb | 6 | ||||
-rw-r--r-- | activesupport/lib/active_support/message_verifier.rb | 6 | ||||
-rw-r--r-- | activesupport/test/message_encryptor_test.rb | 13 |
3 files changed, 20 insertions, 5 deletions
diff --git a/activesupport/lib/active_support/message_encryptor.rb b/activesupport/lib/active_support/message_encryptor.rb index bffdfc6201..7773611e11 100644 --- a/activesupport/lib/active_support/message_encryptor.rb +++ b/activesupport/lib/active_support/message_encryptor.rb @@ -76,12 +76,12 @@ module ActiveSupport encrypted_data = cipher.update(@serializer.dump(value)) encrypted_data << cipher.final - [encrypted_data, iv].map {|v| ::Base64.strict_encode64(v)}.join("--") + "#{::Base64.strict_encode64 encrypted_data}--#{::Base64.strict_encode64 iv}" end def _decrypt(encrypted_message) cipher = new_cipher - encrypted_data, iv = encrypted_message.split("--").map {|v| ::Base64.decode64(v)} + encrypted_data, iv = encrypted_message.split("--").map {|v| ::Base64.strict_decode64(v)} cipher.decrypt cipher.key = @secret @@ -91,7 +91,7 @@ module ActiveSupport decrypted_data << cipher.final @serializer.load(decrypted_data) - rescue OpenSSLCipherError, TypeError + rescue OpenSSLCipherError, TypeError, ArgumentError raise InvalidMessage end diff --git a/activesupport/lib/active_support/message_verifier.rb b/activesupport/lib/active_support/message_verifier.rb index e0cd92ae3c..a35d5980fe 100644 --- a/activesupport/lib/active_support/message_verifier.rb +++ b/activesupport/lib/active_support/message_verifier.rb @@ -37,7 +37,11 @@ module ActiveSupport data, digest = signed_message.split("--") if data.present? && digest.present? && secure_compare(digest, generate_digest(data)) - @serializer.load(::Base64.decode64(data)) + begin + @serializer.load(::Base64.strict_decode64(data)) + rescue ArgumentError + raise InvalidSignature + end else raise InvalidSignature end diff --git a/activesupport/test/message_encryptor_test.rb b/activesupport/test/message_encryptor_test.rb index 203156baa1..b6c0a08b05 100644 --- a/activesupport/test/message_encryptor_test.rb +++ b/activesupport/test/message_encryptor_test.rb @@ -66,6 +66,17 @@ class MessageEncryptorTest < ActiveSupport::TestCase ActiveSupport.use_standard_json_time_format = prev end + def test_message_obeys_strict_encoding + bad_encoding_characters = "\n!@#" + message, iv = @encryptor.encrypt_and_sign("This is a very \n\nhumble string"+bad_encoding_characters) + + assert_not_decrypted("#{::Base64.encode64 message.to_s}--#{::Base64.encode64 iv.to_s}") + assert_not_verified("#{::Base64.encode64 message.to_s}--#{::Base64.encode64 iv.to_s}") + + assert_not_decrypted([iv, message] * bad_encoding_characters) + assert_not_verified([iv, message] * bad_encoding_characters) + end + private def assert_not_decrypted(value) @@ -81,7 +92,7 @@ class MessageEncryptorTest < ActiveSupport::TestCase end def munge(base64_string) - bits = ::Base64.decode64(base64_string) + bits = ::Base64.strict_decode64(base64_string) bits.reverse! ::Base64.strict_encode64(bits) end |