mirror of
https://github.com/go-gitea/gitea
synced 2024-12-22 16:44:26 +00:00
Handle base64 decoding correctly to avoid panic (#26483)
Fix the panic if the "base64 secret" is too long.
This commit is contained in:
parent
cafce3b4b5
commit
ed1be4ca68
@ -70,12 +70,12 @@ func runGenerateInternalToken(c *cli.Context) error {
|
|||||||
}
|
}
|
||||||
|
|
||||||
func runGenerateLfsJwtSecret(c *cli.Context) error {
|
func runGenerateLfsJwtSecret(c *cli.Context) error {
|
||||||
JWTSecretBase64, err := generate.NewJwtSecretBase64()
|
_, jwtSecretBase64, err := generate.NewJwtSecretBase64()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
fmt.Printf("%s", JWTSecretBase64)
|
fmt.Printf("%s", jwtSecretBase64)
|
||||||
|
|
||||||
if isatty.IsTerminal(os.Stdout.Fd()) {
|
if isatty.IsTerminal(os.Stdout.Fd()) {
|
||||||
fmt.Printf("\n")
|
fmt.Printf("\n")
|
||||||
|
@ -49,12 +49,12 @@ func NewJwtSecret() ([]byte, error) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// NewJwtSecretBase64 generates a new base64 encoded value intended to be used for JWT secrets.
|
// NewJwtSecretBase64 generates a new base64 encoded value intended to be used for JWT secrets.
|
||||||
func NewJwtSecretBase64() (string, error) {
|
func NewJwtSecretBase64() ([]byte, string, error) {
|
||||||
bytes, err := NewJwtSecret()
|
bytes, err := NewJwtSecret()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return "", err
|
return nil, "", err
|
||||||
}
|
}
|
||||||
return base64.RawURLEncoding.EncodeToString(bytes), nil
|
return bytes, base64.RawURLEncoding.EncodeToString(bytes), nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// NewSecretKey generate a new value intended to be used by SECRET_KEY.
|
// NewSecretKey generate a new value intended to be used by SECRET_KEY.
|
||||||
|
@ -9,6 +9,7 @@ import (
|
|||||||
"time"
|
"time"
|
||||||
|
|
||||||
"code.gitea.io/gitea/modules/generate"
|
"code.gitea.io/gitea/modules/generate"
|
||||||
|
"code.gitea.io/gitea/modules/util"
|
||||||
)
|
)
|
||||||
|
|
||||||
// LFS represents the configuration for Git LFS
|
// LFS represents the configuration for Git LFS
|
||||||
@ -56,17 +57,14 @@ func loadLFSFrom(rootCfg ConfigProvider) error {
|
|||||||
|
|
||||||
LFS.HTTPAuthExpiry = sec.Key("LFS_HTTP_AUTH_EXPIRY").MustDuration(24 * time.Hour)
|
LFS.HTTPAuthExpiry = sec.Key("LFS_HTTP_AUTH_EXPIRY").MustDuration(24 * time.Hour)
|
||||||
|
|
||||||
if !LFS.StartServer {
|
if !LFS.StartServer || !InstallLock {
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
LFS.JWTSecretBase64 = loadSecret(rootCfg.Section("server"), "LFS_JWT_SECRET_URI", "LFS_JWT_SECRET")
|
LFS.JWTSecretBase64 = loadSecret(rootCfg.Section("server"), "LFS_JWT_SECRET_URI", "LFS_JWT_SECRET")
|
||||||
|
LFS.JWTSecretBytes, err = util.Base64FixedDecode(base64.RawURLEncoding, []byte(LFS.JWTSecretBase64), 32)
|
||||||
LFS.JWTSecretBytes = make([]byte, 32)
|
if err != nil {
|
||||||
n, err := base64.RawURLEncoding.Decode(LFS.JWTSecretBytes, []byte(LFS.JWTSecretBase64))
|
LFS.JWTSecretBytes, LFS.JWTSecretBase64, err = generate.NewJwtSecretBase64()
|
||||||
|
|
||||||
if (err != nil || n != 32) && InstallLock {
|
|
||||||
LFS.JWTSecretBase64, err = generate.NewJwtSecretBase64()
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return fmt.Errorf("error generating JWT Secret for custom config: %v", err)
|
return fmt.Errorf("error generating JWT Secret for custom config: %v", err)
|
||||||
}
|
}
|
||||||
|
@ -10,6 +10,7 @@ import (
|
|||||||
|
|
||||||
"code.gitea.io/gitea/modules/generate"
|
"code.gitea.io/gitea/modules/generate"
|
||||||
"code.gitea.io/gitea/modules/log"
|
"code.gitea.io/gitea/modules/log"
|
||||||
|
"code.gitea.io/gitea/modules/util"
|
||||||
)
|
)
|
||||||
|
|
||||||
// OAuth2UsernameType is enum describing the way gitea 'name' should be generated from oauth2 data
|
// OAuth2UsernameType is enum describing the way gitea 'name' should be generated from oauth2 data
|
||||||
@ -129,21 +130,19 @@ func loadOAuth2From(rootCfg ConfigProvider) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
if InstallLock {
|
if InstallLock {
|
||||||
key := make([]byte, 32)
|
if _, err := util.Base64FixedDecode(base64.RawURLEncoding, []byte(OAuth2.JWTSecretBase64), 32); err != nil {
|
||||||
n, err := base64.RawURLEncoding.Decode(key, []byte(OAuth2.JWTSecretBase64))
|
key, err := generate.NewJwtSecret()
|
||||||
if err != nil || n != 32 {
|
|
||||||
key, err = generate.NewJwtSecret()
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
log.Fatal("error generating JWT secret: %v", err)
|
log.Fatal("error generating JWT secret: %v", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
secretBase64 := base64.RawURLEncoding.EncodeToString(key)
|
OAuth2.JWTSecretBase64 = base64.RawURLEncoding.EncodeToString(key)
|
||||||
saveCfg, err := rootCfg.PrepareSaving()
|
saveCfg, err := rootCfg.PrepareSaving()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
log.Fatal("save oauth2.JWT_SECRET failed: %v", err)
|
log.Fatal("save oauth2.JWT_SECRET failed: %v", err)
|
||||||
}
|
}
|
||||||
rootCfg.Section("oauth2").Key("JWT_SECRET").SetValue(secretBase64)
|
rootCfg.Section("oauth2").Key("JWT_SECRET").SetValue(OAuth2.JWTSecretBase64)
|
||||||
saveCfg.Section("oauth2").Key("JWT_SECRET").SetValue(secretBase64)
|
saveCfg.Section("oauth2").Key("JWT_SECRET").SetValue(OAuth2.JWTSecretBase64)
|
||||||
if err := saveCfg.Save(); err != nil {
|
if err := saveCfg.Save(); err != nil {
|
||||||
log.Fatal("save oauth2.JWT_SECRET failed: %v", err)
|
log.Fatal("save oauth2.JWT_SECRET failed: %v", err)
|
||||||
}
|
}
|
||||||
|
@ -6,6 +6,7 @@ package util
|
|||||||
import (
|
import (
|
||||||
"bytes"
|
"bytes"
|
||||||
"crypto/rand"
|
"crypto/rand"
|
||||||
|
"encoding/base64"
|
||||||
"fmt"
|
"fmt"
|
||||||
"math/big"
|
"math/big"
|
||||||
"strconv"
|
"strconv"
|
||||||
@ -261,3 +262,13 @@ func ToFloat64(number any) (float64, error) {
|
|||||||
func ToPointer[T any](val T) *T {
|
func ToPointer[T any](val T) *T {
|
||||||
return &val
|
return &val
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func Base64FixedDecode(encoding *base64.Encoding, src []byte, length int) ([]byte, error) {
|
||||||
|
decoded := make([]byte, encoding.DecodedLen(len(src))+3)
|
||||||
|
if n, err := encoding.Decode(decoded, src); err != nil {
|
||||||
|
return nil, err
|
||||||
|
} else if n != length {
|
||||||
|
return nil, fmt.Errorf("invalid base64 decoded length: %d, expects: %d", n, length)
|
||||||
|
}
|
||||||
|
return decoded[:length], nil
|
||||||
|
}
|
||||||
|
@ -4,6 +4,7 @@
|
|||||||
package util
|
package util
|
||||||
|
|
||||||
import (
|
import (
|
||||||
|
"encoding/base64"
|
||||||
"regexp"
|
"regexp"
|
||||||
"strings"
|
"strings"
|
||||||
"testing"
|
"testing"
|
||||||
@ -233,3 +234,16 @@ func TestToPointer(t *testing.T) {
|
|||||||
val123 := 123
|
val123 := 123
|
||||||
assert.False(t, &val123 == ToPointer(val123))
|
assert.False(t, &val123 == ToPointer(val123))
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func TestBase64FixedDecode(t *testing.T) {
|
||||||
|
_, err := Base64FixedDecode(base64.RawURLEncoding, []byte("abcd"), 32)
|
||||||
|
assert.ErrorContains(t, err, "invalid base64 decoded length")
|
||||||
|
_, err = Base64FixedDecode(base64.RawURLEncoding, []byte(strings.Repeat("a", 64)), 32)
|
||||||
|
assert.ErrorContains(t, err, "invalid base64 decoded length")
|
||||||
|
|
||||||
|
str32 := strings.Repeat("x", 32)
|
||||||
|
encoded32 := base64.RawURLEncoding.EncodeToString([]byte(str32))
|
||||||
|
decoded32, err := Base64FixedDecode(base64.RawURLEncoding, []byte(encoded32), 32)
|
||||||
|
assert.NoError(t, err)
|
||||||
|
assert.Equal(t, str32, string(decoded32))
|
||||||
|
}
|
||||||
|
@ -415,7 +415,7 @@ func SubmitInstall(ctx *context.Context) {
|
|||||||
cfg.Section("server").Key("LFS_START_SERVER").SetValue("true")
|
cfg.Section("server").Key("LFS_START_SERVER").SetValue("true")
|
||||||
cfg.Section("lfs").Key("PATH").SetValue(form.LFSRootPath)
|
cfg.Section("lfs").Key("PATH").SetValue(form.LFSRootPath)
|
||||||
var lfsJwtSecret string
|
var lfsJwtSecret string
|
||||||
if lfsJwtSecret, err = generate.NewJwtSecretBase64(); err != nil {
|
if _, lfsJwtSecret, err = generate.NewJwtSecretBase64(); err != nil {
|
||||||
ctx.RenderWithErr(ctx.Tr("install.lfs_jwt_secret_failed", err), tplInstall, &form)
|
ctx.RenderWithErr(ctx.Tr("install.lfs_jwt_secret_failed", err), tplInstall, &form)
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
@ -336,16 +336,7 @@ func InitSigningKey() error {
|
|||||||
// loadSymmetricKey checks if the configured secret is valid.
|
// loadSymmetricKey checks if the configured secret is valid.
|
||||||
// If it is not valid, it will return an error.
|
// If it is not valid, it will return an error.
|
||||||
func loadSymmetricKey() (any, error) {
|
func loadSymmetricKey() (any, error) {
|
||||||
key := make([]byte, 32)
|
return util.Base64FixedDecode(base64.RawURLEncoding, []byte(setting.OAuth2.JWTSecretBase64), 32)
|
||||||
n, err := base64.RawURLEncoding.Decode(key, []byte(setting.OAuth2.JWTSecretBase64))
|
|
||||||
if err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
if n != 32 {
|
|
||||||
return nil, fmt.Errorf("JWT secret must be 32 bytes long")
|
|
||||||
}
|
|
||||||
|
|
||||||
return key, nil
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// loadOrCreateAsymmetricKey checks if the configured private key exists.
|
// loadOrCreateAsymmetricKey checks if the configured private key exists.
|
||||||
|
Loading…
Reference in New Issue
Block a user