31ee934 · skrepka · git.iko.soy

git.iko.soy/skrepka

on master help sign in

Add hex validation for messageIds in ForwardMessage, AckMessages, and FederationAck

31ee934iko7 months ago

server.knot+3−1

compare with master

unifiedsplit

@@ -378,6 +378,7 @@ serve = \req -> case req of

378 t <- now

379 let dedupedIds = fold (\acc mid ->

380 if mid == "" then acc

381+ else if not (isValidHex mid) then acc

381 else if tooLong mid maxPubkeyLen then acc

382 else if tooLong mid maxPubkeyLen then acc

382 else if count acc >= maxMessageIds then acc

383 else if count acc >= maxMessageIds then acc

383 else if count (do a <- acc; where a == mid; yield a) > 0 then acc

384 else if count (do a <- acc; where a == mid; yield a) > 0 then acc

@@ -620,7 +621,7 @@ serve = \req -> case req of

620 t <- now

621 t <- now

621 let authorized = verifyFederationAuth authorization

622 let authorized = verifyFederationAuth authorization

622 let validOrigin = not (originServer == "") && not (originServer == serverHost)

623 let validOrigin = not (originServer == "") && not (originServer == serverHost)

623− let validFields = not (toKey == "") && not (fromKey == "") && not (encryptedBlob == "") && not (messageId == "") && isValidHex toKey && isValidHex fromKey && not (tooLong toKey maxPubkeyLen) && not (tooLong fromKey maxPubkeyLen) && not (tooLong encryptedBlob maxBlobLen) && not (tooLong messageId maxPubkeyLen)

624+ let validFields = not (toKey == "") && not (fromKey == "") && not (encryptedBlob == "") && not (messageId == "") && isValidHex toKey && isValidHex fromKey && isValidHex messageId && not (tooLong toKey maxPubkeyLen) && not (tooLong fromKey maxPubkeyLen) && not (tooLong encryptedBlob maxBlobLen) && not (tooLong messageId maxPubkeyLen)

624 let clampedTs = if timestamp > t then t else if timestamp < t - messageMaxAge then t else timestamp

625 let clampedTs = if timestamp > t then t else if timestamp < t - messageMaxAge then t else timestamp

625 pruneResult <- atomic do

626 pruneResult <- atomic do

626 pr <- pruneExpired t

627 pr <- pruneExpired t

@@ -648,6 +649,7 @@ serve = \req -> case req of

648 let authorized = verifyFederationAuth authorization

649 let authorized = verifyFederationAuth authorization

649 let dedupedIds = fold (\acc mid ->

650 let dedupedIds = fold (\acc mid ->

650 if mid == "" then acc

651 if mid == "" then acc

652+ else if not (isValidHex mid) then acc

651 else if tooLong mid maxPubkeyLen then acc

653 else if tooLong mid maxPubkeyLen then acc

652 else if count acc >= maxMessageIds then acc

654 else if count acc >= maxMessageIds then acc

653 else if count (do a <- acc; where a == mid; yield a) > 0 then acc

655 else if count (do a <- acc; where a == mid; yield a) > 0 then acc