Repository navigation
loop/foundation 2026 06 22 162643 - #343
Merged
Merged
Conversation
bordumb
commented
Jun 22, 2026
bordumb
commented
Contributor
- fix(auths-keri): guard receipt-couple parsing against malformed CESR
- fix(auths-keri): fail closed on a malformed CESR primitive in decode_qualified
- refactor(auths-keri): derive verkey length validation from the shared guard
- test(auths-keri): fuzz the receipt-couple parser + wire it into CI
- style: rustfmt the new CESR parse-guard code
- fix(auths-keri): reject non-ASCII CESR attachments before slicing
- test(auths-keri): fuzz the attachment parsers + wire into CI
parse_nontrans_receipt_couples handed the raw attachment stream straight to the CESR verkey/signature decoder, which slices the input by a length derived from the derivation code and panics out of bounds on a truncated or variable-length code. Add a shared take_matter_qb64 helper that reads the code, validates the input is ASCII and holds the full primitive, and returns its exact qb64 width before the decoder runs, so a malformed couple fails closed with a typed error. Adds a regression test. Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Anchor-Seq: 1
…qualified decode_qualified passed untrusted input straight to the verkey/digest decoder (out-of-bounds panic on a short variable-length code) and, on the miss path, sliced the error message at a fixed byte offset (panic when it split a multi-byte char). Take the exact primitive width via the shared guard first, so both the decode and the error message operate on a validated, bounded, ASCII primitive. Adds a regression test. Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Anchor-Seq: 1
… guard KeriPublicKey::parse carried its own copy of the verkey qb64 lengths (44/48) and prefix checks. Route it through the shared take_matter_qb64 helper so those sizes live in one place, and reject trailing bytes after the primitive. No behavior change — the existing parse battery is the regression. Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Anchor-Seq: 1
Adds a cargo-fuzz target over parse_nontrans_receipt_couples (invariant: never panic on attacker bytes) and adds it to the CI fuzz-smoke matrix. The parser now prevents the out-of-bounds decoder panic rather than relying on unwinding, so the target builds and runs clean. Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Anchor-Seq: 1
Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Anchor-Seq: 1
The -A signature and -G source-seal attachment readers sliced the qb64 stream at byte offsets derived from each primitive's code, checking only the byte length — so a multi-byte UTF-8 char straddling a slice boundary panicked. These parsers run over a presented bundle's attachments in the offline verifier before any signature is checked. CESR qb64 is ASCII, so reject non-ASCII at the parser boundary; the byte-offset slices are then always on char boundaries. Adds a regression test. Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Anchor-Seq: 1
Adds a cargo-fuzz target over parse_attachment / parse_delegated_attachment (the -A/-G readers the offline verifier runs over presented attachments; invariant: never panic on attacker bytes) and adds it to the CI fuzz-smoke matrix. Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Anchor-Seq: 1
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Auths Commit Verification
Result: ❌ 0/7 commits verified How to fixCommit 1. Install auths macOS: 2. One-time setup (creates your identity and configures Git) auths init3. Sign this branch and push auths sign origin/main..HEAD
git push --force-with-leaseFor CI to verify the signer, commit an identity bundle: auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.