From aceaa698fc7ef4d6563715c4ea1c8a035a0c62a2 Mon Sep 17 00:00:00 2001 From: mvdbeek Date: Thu, 8 Sep 2022 14:04:35 +0200 Subject: [PATCH] Ensure guid is hexadecimal value --- lib/galaxy/security/idencoding.py | 16 +++++++++++----- test/unit/data/security/test_id_encode_decode.py | 11 +++++++++++ 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/lib/galaxy/security/idencoding.py b/lib/galaxy/security/idencoding.py index cf3fa57aef0..b66a0f04cff 100644 --- a/lib/galaxy/security/idencoding.py +++ b/lib/galaxy/security/idencoding.py @@ -1,7 +1,10 @@ import codecs import collections import logging -from typing import Optional +from typing import ( + Optional, + Union, +) from Crypto.Cipher import Blowfish from Crypto.Random import get_random_bytes @@ -102,15 +105,18 @@ class IdEncodingHelper: # Encrypt return codecs.encode(self.id_cipher.encrypt(s), "hex") - def decode_guid(self, session_key): + def decode_guid(self, session_key: Union[bytes, str]) -> str: # Session keys are strings try: decoded_session_key = codecs.decode(session_key, "hex") - return unicodify(self.id_cipher.decrypt(decoded_session_key)).lstrip("!") + stripped_decoded_session_key = unicodify(self.id_cipher.decrypt(decoded_session_key)).lstrip("!") + # Ensure session key is hexadecimal value + int(stripped_decoded_session_key, 16) + return stripped_decoded_session_key except TypeError: - raise galaxy.exceptions.MalformedId(f"Malformed guid '{session_key}' specified, unable to decode.") + raise galaxy.exceptions.MalformedId(f"Malformed guid '{session_key!r}' specified, unable to decode.") except ValueError: - raise galaxy.exceptions.MalformedId(f"Wrong guid '{session_key}' specified, unable to decode.") + raise galaxy.exceptions.MalformedId(f"Wrong guid '{session_key!r}' specified, unable to decode.") def get_new_guid(self): # Generate a unique, high entropy 128 bit random number diff --git a/test/unit/data/security/test_id_encode_decode.py b/test/unit/data/security/test_id_encode_decode.py index 7b9ffc8f839..45cf930416f 100644 --- a/test/unit/data/security/test_id_encode_decode.py +++ b/test/unit/data/security/test_id_encode_decode.py @@ -62,6 +62,17 @@ def test_maximum_length_handling_nonascii(): assert e11 != e12 +def test_unicode_null_decoding(): + encoded_id = test_helper_1.encode_id(1) + threw_exception = False + try: + test_helper_1.decode_guid(f"{encoded_id[:-1]}\0") + except Exception: + threw_exception = True + + assert threw_exception + + def test_encode_decode(): # Different ids are encoded differently assert test_helper_1.encode_id(1) != test_helper_1.encode_id(2)