highperfocused/bitcoin
1
0
Fork 0
mirror of https://github.com/bitcoin/bitcoin.git synced 2025-04-07 19:48:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Reject incorrect base64 in HTTP auth

Browse Source 
In addition, to make sure that no call site ignores the invalid
decoding status, make the pf_invalid argument mandatory.
This commit is contained in:
Pieter Wuille 2022-04-08 23:17:01 -04:00 committed by MacroFake
parent d648b5120b
commit a4377a0843
5 changed files with 17 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/httprpc.cpp
View File

@ -132,7 +132,9 @@ static bool RPCAuthorized(const std::string& strAuth, std::string& strAuthUserna
if (strAuth.substr(0, 6) != "Basic ")
return false;
std::string strUserPass64 = TrimString(strAuth.substr(6));
std::string strUserPass = DecodeBase64(strUserPass64);
bool invalid;
std::string strUserPass = DecodeBase64(strUserPass64, &invalid);
if (invalid) return false;
if (strUserPass.find(':') != std::string::npos)
strAuthUsernameOut = strUserPass.substr(0, strUserPass.find(':'));

4
src/test/base32_tests.cpp
View File

@ -22,7 +22,9 @@ BOOST_AUTO_TEST_CASE(base32_testvectors)
BOOST_CHECK_EQUAL(strEnc, vstrOut[i]);
strEnc = EncodeBase32(vstrIn[i], false);
BOOST_CHECK_EQUAL(strEnc, vstrOutNoPadding[i]);
std::string strDec = DecodeBase32(vstrOut[i]);
bool invalid;
std::string strDec = DecodeBase32(vstrOut[i], &invalid);
BOOST_CHECK(!invalid);
BOOST_CHECK_EQUAL(strDec, vstrIn[i]);
}

4
src/test/base64_tests.cpp
View File

@ -19,7 +19,9 @@ BOOST_AUTO_TEST_CASE(base64_testvectors)
{
std::string strEnc = EncodeBase64(vstrIn[i]);
BOOST_CHECK_EQUAL(strEnc, vstrOut[i]);
std::string strDec = DecodeBase64(strEnc);
bool invalid;
std::string strDec = DecodeBase64(strEnc, &invalid);
BOOST_CHECK(!invalid);
BOOST_CHECK_EQUAL(strDec, vstrIn[i]);
}

12
src/util/strencodings.cpp
View File

@ -167,7 +167,7 @@ std::vector<unsigned char> DecodeBase64(const char* p, bool* pf_invalid)
++p;
}
valid = valid && (p - e) % 4 == 0 && p - q < 4;
if (pf_invalid) *pf_invalid = !valid;
*pf_invalid = !valid;
return ret;
}
@ -175,9 +175,7 @@ std::vector<unsigned char> DecodeBase64(const char* p, bool* pf_invalid)
std::string DecodeBase64(const std::string& str, bool* pf_invalid)
{
if (!ValidAsCString(str)) {
if (pf_invalid) {
*pf_invalid = true;
}
*pf_invalid = true;
return {};
}
std::vector<unsigned char> vchRet = DecodeBase64(str.c_str(), pf_invalid);
@ -245,7 +243,7 @@ std::vector<unsigned char> DecodeBase32(const char* p, bool* pf_invalid)
++p;
}
valid = valid && (p - e) % 8 == 0 && p - q < 8;
if (pf_invalid) *pf_invalid = !valid;
*pf_invalid = !valid;
return ret;
}
@ -253,9 +251,7 @@ std::vector<unsigned char> DecodeBase32(const char* p, bool* pf_invalid)
std::string DecodeBase32(const std::string& str, bool* pf_invalid)
{
if (!ValidAsCString(str)) {
if (pf_invalid) {
*pf_invalid = true;
}
*pf_invalid = true;
return {};
}
std::vector<unsigned char> vchRet = DecodeBase32(str.c_str(), pf_invalid);

8
src/util/strencodings.h
View File

@ -64,13 +64,13 @@ bool IsHex(std::string_view str);
* Return true if the string is a hex number, optionally prefixed with "0x"
*/
bool IsHexNumber(std::string_view str);
std::vector<unsigned char> DecodeBase64(const char* p, bool* pf_invalid = nullptr);
std::string DecodeBase64(const std::string& str, bool* pf_invalid = nullptr);
std::vector<unsigned char> DecodeBase64(const char* p, bool* pf_invalid);
std::string DecodeBase64(const std::string& str, bool* pf_invalid);
std::string EncodeBase64(Span<const unsigned char> input);
inline std::string EncodeBase64(Span<const std::byte> input) { return EncodeBase64(MakeUCharSpan(input)); }
inline std::string EncodeBase64(const std::string& str) { return EncodeBase64(MakeUCharSpan(str)); }
std::vector<unsigned char> DecodeBase32(const char* p, bool* pf_invalid = nullptr);
std::string DecodeBase32(const std::string& str, bool* pf_invalid = nullptr);
std::vector<unsigned char> DecodeBase32(const char* p, bool* pf_invalid);
std::string DecodeBase32(const std::string& str, bool* pf_invalid);
/**
* Base32 encode.