Mirrors/keyoxide-web
1
0
Fork 1
mirror of https://codeberg.org/keyoxide/keyoxide-web.git synced 2024-12-22 14:59:29 -07:00
Code Issues Projects Releases Packages Wiki Activity

fix: Fix fingerprint sanitization

Browse source
This commit is contained in:
Yarmo Mackenbach 2023-03-02 09:38:01 +01:00
parent 9982d8cfc9
commit 769e256405
No known key found for this signature in database
GPG key ID: 37367F4AF4087AD1
1 changed files with 5 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/server/keys.js
View file

@ -124,22 +124,20 @@ const fetchHKP = (id, keyserverDomain) => {
keyserverDomain = keyserverDomain || 'keys.openpgp.org' keyserverDomain = keyserverDomain || 'keys.openpgp.org'
let query = '' let query = ''
let sanitizedId = '';
if (id.includes('@')) { if (id.includes('@')) {
query = id query = id
} else { } else {
const whitespaceRegex = /\s/g; let sanitizedId = id
const whitespaceRegex = /\s/g
if (whitespaceRegex.test(id)) { if (whitespaceRegex.test(id)) {
sanitizedId = id.replaceAll(whitespaceRegex, ''); sanitizedId = id.replaceAll(whitespaceRegex, '')
} else {
sanitizedId = id;
} }
query = `0x${sanitizedId}` query = `0x${sanitizedId}`
} }
output.fetchURL = `https://${keyserverDomain}/pks/lookup?op=get&options=mr&search=${query}` output.fetchURL = `https://${keyserverDomain}/pks/lookup?op=get&options=mr&search=${query}`
const hash = createHash('md5').update(`${sanitizedId}__${keyserverDomain}`).digest('hex') const hash = createHash('md5').update(`${query}__${keyserverDomain}`).digest('hex')
if (c && await c.get(hash)) { if (c && await c.get(hash)) {
output.publicKey = await readKey({ output.publicKey = await readKey({
@ -147,7 +145,7 @@ const fetchHKP = (id, keyserverDomain) => {
}) })
} else { } else {
try { try {
output.publicKey = await doipjs.keys.fetchHKP(sanitizedId, keyserverDomain) output.publicKey = await doipjs.keys.fetchHKP(query, keyserverDomain)
} catch (error) { } catch (error) {
reject(new Error('No public keys could be fetched using HKP')) reject(new Error('No public keys could be fetched using HKP'))
} }