push --signed: tighten what the receiving end can ask to sign
Instead of blindly trusting the receiving side to give us a sensible nonce to sign, limit the length (max 256 bytes) and the alphabet (alnum and a few selected punctuations, enough to encode in base64) that can be used in nonce. Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano committed
Apr 1, 2015 at 18:00 UTC
afcb6ee30acf17f4e0338c49fbab301131abfbba
1 file changed
+23
send-pack.c
+23
@@ -279,6 +279,28 @@ free_return:
279
return update_seen;
280
}
281
282
+#define NONCE_LEN_LIMIT 256
283
+
284
+static void reject_invalid_nonce(const char *nonce, int len)
285
+{
286
+ int i = 0;
287
+
288
+ if (NONCE_LEN_LIMIT <= len)
289
+ die("the receiving end asked to sign an invalid nonce <%.*s>",
290
+ len, nonce);
291
+
292
+ for (i = 0; i < len; i++) {
293
+ int ch = nonce[i] & 0xFF;
294
+ if (isalnum(ch) ||
295
+ ch == '-' || ch == '.' ||
296
+ ch == '/' || ch == '+' ||
297
+ ch == '=' || ch == '_')
298
+ continue;
299
+ die("the receiving end asked to sign an invalid nonce <%.*s>",
300
+ len, nonce);
301
+ }
302
+}
303
+
304
int send_pack(struct send_pack_args *args,
305
int fd[], struct child_process *conn,
306
struct ref *remote_refs,
@@ -321,6 +343,7 @@ int send_pack(struct send_pack_args *args,
343
push_cert_nonce = server_feature_value("push-cert", &len);
344
if (!push_cert_nonce)
345
die(_("the receiving end does not support --signed push"));
346
+ reject_invalid_nonce(push_cert_nonce, len);
347
push_cert_nonce = xmemdupz(push_cert_nonce, len);
348
}
349