@cryptotaxi247 / MeshCentral / commits / 9372f766

Added more authenticode-js error handling, #4134

Ylian Saint-Hilaire committed Jun 21, 2022 at 19:06 UTC 9372f7666c11d41943646e242aac857625a6951d
1 file changed +13 -8
authenticode.js
+13 -8
@@ -426,10 +426,12 @@ function createAuthenticodeHandler(path) {
426 res.on('data', function (chunk) { responseAccumulator += chunk; });
427 res.on('end', function () {
428 // Decode the timestamp signature block
429 - const timepkcs7der = forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(responseAccumulator, 'base64').toString('binary')));
429 + var timepkcs7der = null;
430 + try { timepkcs7der = forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(responseAccumulator, 'base64').toString('binary'))); } catch (ex) { func('' + ex); return; }
431
432 // Decode the executable signature block
432 - const pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(obj.getRawSignatureBlock(), 'base64').toString('binary')));
433 + var pkcs7der = null;
434 + try { forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(obj.getRawSignatureBlock(), 'base64').toString('binary'))); } catch (ex) { func('' + ex); return; }
435
436 // Get the ASN1 certificates used to sign the timestamp and add them to the certs in the PKCS7 of the executable
437 // TODO: We could look to see if the certificate is already present in the executable
@@ -1291,7 +1293,8 @@ function createAuthenticodeHandler(path) {
1293 signEx(args, p7signature, obj.filesize, func);
1294 } else {
1295 // Decode the signature block
1294 - var pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(p7signature));
1296 + var pkcs7der = null;
1297 + try { forge.asn1.fromDer(forge.util.createBuffer(p7signature)); } catch (ex) { func('' + ex); return; }
1298
1299 // To work around ForgeJS PKCS#7 limitation, this may break PKCS7 verify if ForgeJS adds support for it in the future
1300 // Switch content type from "1.3.6.1.4.1.311.2.1.4" to "1.2.840.113549.1.7.1"
@@ -1316,7 +1319,7 @@ function createAuthenticodeHandler(path) {
1319 ]);
1320
1321 // Re-decode the PKCS7 from the executable, this time, no workaround needed
1319 - pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(p7signature));
1322 + try { pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(p7signature)); } catch (ex) { func('' + ex); return; }
1323
1324 // Serialize an ASN.1 object to DER format in Base64
1325 const requestBody = Buffer.from(asn1.toDer(asn1obj).data, 'binary').toString('base64');
@@ -1341,7 +1344,8 @@ function createAuthenticodeHandler(path) {
1344 res.on('data', function (chunk) { responseAccumulator += chunk; });
1345 res.on('end', function () {
1346 // Decode the timestamp signature block
1344 - const timepkcs7der = forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(responseAccumulator, 'base64').toString('binary')));
1347 + const timepkcs7der = null;
1348 + try { forge.asn1.fromDer(forge.util.createBuffer(Buffer.from(responseAccumulator, 'base64').toString('binary'))); } catch (ex) { func('' + ex); return; }
1349
1350 // Get the ASN1 certificates used to sign the timestamp and add them to the certs in the PKCS7 of the executable
1351 // TODO: We could look to see if the certificate is already present in the executable
@@ -1562,7 +1566,7 @@ function createAuthenticodeHandler(path) {
1566 if (args.hash == 'sha512') { hashOid = forge.pki.oids.sha512; fileHash = obj.getHashOfFile(output, 'sha512', written); }
1567 if (args.hash == 'sha224') { hashOid = forge.pki.oids.sha224; fileHash = obj.getHashOfFile(output, 'sha224', written); }
1568 if (args.hash == 'md5') { hashOid = forge.pki.oids.md5; fileHash = obj.getHashOfFile(output, 'md5', written); }
1565 - if (hashOid == null) return false;
1569 + if (hashOid == null) { func('Bad hash method OID'); return; }
1570
1571 // Create the signature block
1572 var xp7 = forge.pkcs7.createSignedData();
@@ -1605,7 +1609,8 @@ function createAuthenticodeHandler(path) {
1609 writeExecutableEx(output, p7signature, written, func);
1610 } else {
1611 // Decode the signature block
1608 - var pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(p7signature));
1612 + var pkcs7der = null;
1613 + try { pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(p7signature)); } catch (ex) { func('' + ex); return; }
1614
1615 // To work around ForgeJS PKCS#7 limitation, this may break PKCS7 verify if ForgeJS adds support for it in the future
1616 // Switch content type from "1.3.6.1.4.1.311.2.1.4" to "1.2.840.113549.1.7.1"
@@ -1630,7 +1635,7 @@ function createAuthenticodeHandler(path) {
1635 ]);
1636
1637 // Re-decode the PKCS7 from the executable, this time, no workaround needed
1633 - pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(p7signature));
1638 + try { pkcs7der = forge.asn1.fromDer(forge.util.createBuffer(p7signature)); } catch (ex) { func('' + ex); return; }
1639
1640 // Serialize an ASN.1 object to DER format in Base64
1641 const requestBody = Buffer.from(asn1.toDer(asn1obj).data, 'binary').toString('base64');