prosody
62100f31eb8a
util/jwt.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Comparison

util/jwt.lua @ 12738:62100f31eb8a

util.jwt: More robust ECDSA signature parsing, fail early on unexpected length
author Matthew Wild <mwild1@gmail.com>
date Fri, 30 Sep 2022 20:38:31 +0100
parent 12736:ad4ab01f9b11
child 12975:d10957394a3c
comparison
equal deleted inserted replaced
12737:924bc1c8d0d9 12738:62100f31eb8a
139 local function encode_ecdsa_sig(der_sig) 139 local function encode_ecdsa_sig(der_sig)
140 local r, s = crypto.parse_ecdsa_signature(der_sig, sig_bytes); 140 local r, s = crypto.parse_ecdsa_signature(der_sig, sig_bytes);
141 return r..s; 141 return r..s;
142 end 142 end
143 143
144 local expected_sig_length = sig_bytes*2;
144 local function decode_ecdsa_sig(jwk_sig) 145 local function decode_ecdsa_sig(jwk_sig)
145 return crypto.build_ecdsa_signature(jwk_sig:sub(1, sig_bytes), jwk_sig:sub(sig_bytes+1, sig_bytes*2)); 146 if #jwk_sig ~= expected_sig_length then
147 return nil;
148 end
149 return crypto.build_ecdsa_signature(jwk_sig:sub(1, sig_bytes), jwk_sig:sub(sig_bytes+1));
146 end 150 end
147 return new_crypto_algorithm(name, "id-ecPublicKey", c_sign, c_verify, encode_ecdsa_sig, decode_ecdsa_sig); 151 return new_crypto_algorithm(name, "id-ecPublicKey", c_sign, c_verify, encode_ecdsa_sig, decode_ecdsa_sig);
148 end 152 end
149 153
150 local algorithms = { 154 local algorithms = {