Make code robust for XML keys with garbage input data

badkeys · Feb 1, 2025 · cc8b4ed · cc8b4ed
1 parent cdda53d
commit cc8b4ed
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/keyfinder.py b/keyfinder.py
@@ -308,7 +308,7 @@ def getxmlkey(kstr):
         n = int.from_bytes(base64.b64decode(n), byteorder="big")
         e = int.from_bytes(base64.b64decode(e), byteorder="big")
         d = int.from_bytes(base64.b64decode(d), byteorder="big")
-    except binascii.Error:
+    except (binascii.Error, ValueError):
         return None
     return makersa(n, e, d)
 

diff --git a/tests/data/invalid/xkms-invalidbinary.xml b/tests/data/invalid/xkms-invalidbinary.xml
@@ -0,0 +1,11 @@
+<RSAKeyPair xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.w3.org/2002/03/xkms#">
+<!-- XKMS key with binary garbage data -->
+<Modulus>sÔ¶ç”Q{FTH</Modulus>
+<Exponent>AQAB</Exponent>
+<P>Xgjziw==</P>
+<Q>30OIuw==</Q>
+<DP>c8y+Rw==</DP>
+<DQ>Enz9Bw==</DQ>
+<InverseQ>jXsByw==</InverseQ>
+<D>TValP0==</D>
+</RSAKeyPair>