prehistoric-systems/keepassxc
1
0
Fork 0
mirror of https://github.com/keepassxreboot/keepassxc.git synced 2026-03-11 08:54:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

SSH Agent: Improve OpenSSH certificate validation

Browse source 
- Check elements non-empty before accessing first()
- Validate minimum 2 elements (type + nonce)
- Reject invalid/unsupported certificate types
- Verify Base64 nonce decoding success
This commit is contained in:
Alexandre Petit 2026-03-09 15:37:11 +01:00
parent 82f6d3ae12
commit 94ef87050a
No known key found for this signature in database
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/sshagent/OpenSSHKey.cpp
View file

@ -693,7 +693,7 @@ bool OpenSSHKey::parseCertificate(QByteArray& data)
"sk-ecdsa-sha2-nistp521-cert-v01@openssh.com",
};
if(!certificateTypeList.contains(elements.first())) {
if(elements.isEmpty() || elements.size() < 2 || !certificateTypeList.contains(elements.first())) {
m_error = tr("Invalid or unsupported certificate file");
return false;
}
@ -701,6 +701,11 @@ bool OpenSSHKey::parseCertificate(QByteArray& data)
m_certificateType = elements.first();
m_rawCertificateData = QByteArray::fromBase64(elements[1].toLatin1());
if (m_rawCertificateData.isEmpty()) {
m_error = tr("Base64 decoding failed");
return false;
}
return true;
}