Skip to content

Fix base64 payload decoding with whitespace #1274

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Vishwa0223 wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Fix base64 payload decoding with whitespace #1274

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
96e2869
Fix base64 payload decoding with whitespace
Vishwa0223 Sep 8, 2026
4fd50ee
Merge branch 'master' into fix-457-payload-key
Vishwa0223 Sep 23, 2026
cb93ae1
Merge branch 'master' into fix-457-payload-key
Vishwa0223 Sep 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 23 additions & 9 deletions keylime-agent/src/keys_handler.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,17 @@ use log::*;
use serde::{Deserialize, Serialize};
use serde_json::json;
use std::convert::TryInto;

fn decode_base64(
data: &str,
) -> std::result::Result<Vec<u8>, base64::DecodeError> {
general_purpose::STANDARD.decode(
data.bytes()
.filter(|byte| !byte.is_ascii_whitespace())
.collect::<Vec<_>>(),
)
}

use tokio::sync::{
mpsc::{Receiver, Sender},
oneshot,
Expand Down Expand Up @@ -142,8 +153,7 @@ async fn u_key(
debug!("Received ukey");

// get key and decode it from web data
let encrypted_key = match general_purpose::STANDARD
.decode(&body.encrypted_key)
let encrypted_key = match decode_base64(&body.encrypted_key)
.map_err(Error::from)
{
Ok(k) => k,
Expand Down Expand Up @@ -213,10 +223,7 @@ async fn u_key(
};

let payload = match &body.payload {
Some(data) => match general_purpose::STANDARD
.decode(data)
.map_err(Error::from)
{
Some(data) => match decode_base64(data).map_err(Error::from) {
Ok(d) => Some(d.into()),
Err(e) => {
warn!("POST u_key returning 400 response. Invalid base64 encoding in payload: {e}");
Expand Down Expand Up @@ -256,8 +263,7 @@ async fn v_key(
debug!("Received vkey");

// get key and decode it from web data
let encrypted_key = match general_purpose::STANDARD
.decode(&body.encrypted_key)
let encrypted_key = match decode_base64(&body.encrypted_key)
.map_err(Error::from)
{
Ok(k) => k,
Expand Down Expand Up @@ -972,7 +978,9 @@ mod tests {
let ukey = KeylimeUKey {
encrypted_key: general_purpose::STANDARD.encode(&encrypted_key),
auth_tag: hex::encode(auth_tag),
payload: payload.map(|p| general_purpose::STANDARD.encode(p)),
payload: payload.map(|p| {
format!("{}\n", general_purpose::STANDARD.encode(p))
}),
};

let req = test::TestRequest::post()
Expand Down Expand Up @@ -1086,6 +1094,12 @@ mod tests {
test_u_or_v_key(AES_256_KEY_LEN, None).await;
}

#[cfg(feature = "testing")]
#[actix_rt::test]
async fn test_u_or_v_key_payload_with_newline() {
test_u_or_v_key(AES_128_KEY_LEN, Some(b"test payload")).await;
Comment thread
Vishwa0223 marked this conversation as resolved.
}

#[cfg(feature = "testing")]
#[actix_rt::test]
async fn test_pubkey() {
Expand Down
Loading