Uploaded image for project: 'COmanage'
  1. COmanage
  2. CO-2823

SshKey addFromKeyFile allows file with multiple keys and newlines

    XMLWordPrintable

Details

    Description

      The function addFromKeyFile in SshKey.php uses explode() to split the text uploaded for an SSH key into the triple of type, key, and comment (this is after the logic that determines whether the key is OpenSSH format or RFC 4716).

      A user could (and has!) combined multiple OpenSSH keys into one file and then uploaded that text.

      The result is a "valid" type, key, and then a comment that contains the original comment from the first key in the upload along with newlines and then the additional keys.

      This invalid comment later ends up being displayed in the view and when trying to click the button to delete it, the invalid comment is sent to the Javascript function js_confirm_generic() which throws an exception because of the newlines in the invalid comment. As a result the Delete button appears to do nothing (the failure is immediately obvious by inspecting the console output in the browser).

      The addFromKeyFile should probably do some simple tests to make sure that the type, key, and comment are reasonable and throw an InvalidArgumentException otherwise.

      At a minimum the logic can make sure there are no newline characters in the comment to prevent the precise failure noted above.

      Attachments

        Issue Links

          Activity

            People

              shayna.atkinson@at.internet2.edu Shayna Atkinson
              scott.koranda@at.internet2.edu Scott Koranda
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: