Skip to content

Reject delegated role names that match a top-level role in any case #3011

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
arpitjain099 wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

Reject delegated role names that match a top-level role in any case #3011

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions tests/test_metadata_serialization.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -490,6 +490,11 @@ def test_invalid_succinct_roles_serialization(self, test_data: str) -> None:
{"keyids": ["keyid1"], "name": "b", "terminating": true, "paths": ["fn1"], "threshold": 3}, \
{"keyids": ["keyid2"], "name": "root", "terminating": true, "paths": ["fn2"], "threshold": 4} ] \
}',
"using top-level role name in a different case": '{"keys": { \
"keyid1" : {"keytype": "rsa", "scheme": "rsassa-pss-sha256", "keyval": {"public": "foo"}}}, \
"roles": [ \
{"keyids": ["keyid1"], "name": "Root", "terminating": true, "paths": ["fn1"], "threshold": 3}] \
}',
"roles and succinct_roles set": '{"keys": { \
"keyid1" : {"keytype": "rsa", "scheme": "rsassa-pss-sha256", "keyval": {"public": "foo"}}, \
"keyid2" : {"keytype": "ed25519", "scheme": "ed25519", "keyval": {"public": "bar"}}}, \
Expand Down
6 changes: 5 additions & 1 deletion tuf/api/_payload.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1428,7 +1428,11 @@ def __init__(

if roles is not None:
for role in roles:
if not role or role in TOP_LEVEL_ROLE_NAMES:
# Compare case-insensitively: the client stores delegated
# metadata as "<quoted rolename>.json", and quoting leaves
# ASCII letters alone, so "Root" and "root" are the same file
# on a case-insensitive filesystem.
if not role or role.lower() in TOP_LEVEL_ROLE_NAMES:
raise ValueError(
"Delegated roles cannot be empty or use top-level "
"role names"
Expand Down
Loading