Git-Mirrors/keepassxc
1
0
Fork 0
mirror of https://github.com/keepassxreboot/keepassxc.git synced 2025-08-03 12:06:25 -04:00
Code Issues Projects Releases Packages Wiki Activity

Check XML key file for valid base64 before using it.

Browse source 
QByteArray::fromBase64() doesn't validate the input.

Closes #366
This commit is contained in:
Felix Geyer 2015-11-01 18:30:50 +01:00
parent 820941fd40
commit 2fa531745f
6 changed files with 25 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/core/Tools.cpp
View file

@ -160,6 +160,16 @@ bool isHex(const QByteArray& ba)
return true;
}
bool isBase64(const QByteArray& ba)
{
QRegExp regexp("^(?:[a-z0-9+/]{4})*(?:[a-z0-9+/]{3}=|[a-z0-9+/]{2}==)?$",
Qt::CaseInsensitive, QRegExp::RegExp2);
QString base64 = QString::fromLatin1(ba.constData(), ba.size());
return regexp.exactMatch(base64);
}
void sleep(int ms)
{
Q_ASSERT(ms >= 0);

1
src/core/Tools.h
View file

@ -35,6 +35,7 @@ bool readAllFromDevice(QIODevice* device, QByteArray& data);
QDateTime currentDateTimeUtc();
QString imageReaderFilter();
bool isHex(const QByteArray& ba);
bool isBase64(const QByteArray& ba);
void sleep(int ms);
void wait(int ms);
QString platform();

5
src/keys/FileKey.cpp
View file

@ -211,7 +211,10 @@ QByteArray FileKey::loadXmlKey(QXmlStreamReader& xmlReader)
while (!xmlReader.error() && xmlReader.readNextStartElement()) {
if (xmlReader.name() == "Data") {
// TODO: do we need to enforce a specific data.size()?
data = QByteArray::fromBase64(xmlReader.readElementText().toLatin1());
QByteArray rawData = xmlReader.readElementText().toLatin1();
if (Tools::isBase64(rawData)) {
data = QByteArray::fromBase64(rawData);
}
}
}