mirrors/age
1
0
Fork 0
mirror of https://github.com/FiloSottile/age.git synced 2026-09-04 07:07:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

armor: reject embedded carriage returns

Browse Source 
Reported by Joe Doyle of Trail of Bits.
This commit is contained in:
Filippo Valsorda
2026-08-29 19:30:10 +02:00
parent 88299a50e4
commit 6424047654
3 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
armor/armor.go
+4
View File
@@ -146,6 +146,10 @@ func (r *armoredReader) Read(p []byte) (int, error) {
if len(line) > format.ColumnsPerLine {
return 0, r.setErr(errors.New("column limit exceeded"))
}
// Reject newline characters ignored by base64.Decode.
if bytes.ContainsAny(line, "\n\r") {
return 0, r.setErr(errors.New("unexpected newline character"))
}
r.unread = r.buf[:]
n, err := base64.StdEncoding.Strict().Decode(r.unread, line)
if err != nil {
go.mod
+1 -1
View File
@@ -16,7 +16,7 @@ require (
// Test dependencies.
require (
c2sp.org/CCTV/age v0.0.0-20260605191406-1e3d2860d46e
c2sp.org/CCTV/age v0.0.0-20260829155415-4448f2097b2d
github.com/rogpeppe/go-internal v1.16.0
golang.org/x/tools v0.49.0 // indirect
)
go.sum
+2 -2
View File
@@ -1,5 +1,5 @@
c2sp.org/CCTV/age v0.0.0-20260605191406-1e3d2860d46e h1:N9DpijOhcuCLIlgcX/6qhBQeMQIlBxsVQITjbpJaBso=
c2sp.org/CCTV/age v0.0.0-20260605191406-1e3d2860d46e/go.mod h1:SrHC2C7r5GkDk8R+NFVzYy/sdj0Ypg9htaPXQq5Cqeo=
c2sp.org/CCTV/age v0.0.0-20260829155415-4448f2097b2d h1:Blprhc2SbChNZtWcU+BLTM4YdoqYAS9V7cJgOwJKyAs=
c2sp.org/CCTV/age v0.0.0-20260829155415-4448f2097b2d/go.mod h1:SrHC2C7r5GkDk8R+NFVzYy/sdj0Ypg9htaPXQq5Cqeo=
filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
filippo.io/hpke v0.4.0 h1:p575VVQ6ted4pL+it6M00V/f2qTZITO0zgmdKCkd5+A=