mirror of
https://git.sr.ht/~rjarry/aerc
synced 2025-07-12 03:00:21 +02:00
5ccd2d0d51
By preparing a maliciously crafted message an attacker could send an encrypted message without signature that would appear as signed within the aerc client. It is caused by the fact that the gpg status messages, which are used for determining the validity signature, are interspered with message contents. An example of such malicious message was added to the `reader_test.go`. This change redirects the satus-fd to stderr, while the usual stderr logs are discarded to /dev/null. In addition to fixing the vulnerability described above, this has the added benefit of stdout containing only useful output which does not need to be filtered. This simplifies the logic and avoids needless copies. Previous stderr parsing logic which detected when no valid OpenPGP data was present is replaced with detecting `NODATA 1` in status-fd messages. The stderr logs are different depending on user locale, thus, they should not be parsed. On the other hand, the status-fd are relatively stable. The previous method of detecting invalid OpenPGP data would fail on systems with non-English locale. Signed-off-by: Marcin Serwin <marcin@serwin.dev> Acked-by: Robin Jarry <robin@jarry.cc>
29 lines
558 B
Go
29 lines
558 B
Go
package gpgbin
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"io"
|
|
|
|
"git.sr.ht/~rjarry/aerc/models"
|
|
)
|
|
|
|
// Sign creates a detached signature based on the contents of r
|
|
func Sign(r io.Reader, from string) ([]byte, string, error) {
|
|
args := []string{
|
|
"--armor",
|
|
"--detach-sign",
|
|
"--default-key", from,
|
|
}
|
|
|
|
g := newGpg(r, args)
|
|
_ = g.cmd.Run()
|
|
|
|
var md models.MessageDetails
|
|
err := parseStatusFd(bytes.NewReader(g.stderr.Bytes()), &md)
|
|
if err != nil {
|
|
return nil, "", fmt.Errorf("failed to parse messagedetails: %w", err)
|
|
}
|
|
|
|
return g.stdout.Bytes(), md.Micalg, nil
|
|
}
|