diff --git a/authlib/consts.py b/authlib/consts.py index e310e793..0eff0669 100644 --- a/authlib/consts.py +++ b/authlib/consts.py @@ -1,5 +1,5 @@ name = 'Authlib' -version = '1.3.0' +version = '1.3.1' author = 'Hsiaoming Yang ' homepage = 'https://authlib.org/' default_user_agent = f'{name}/{version} (+{homepage})' diff --git a/authlib/jose/rfc7518/oct_key.py b/authlib/jose/rfc7518/oct_key.py index 1db321a7..44e1f724 100644 --- a/authlib/jose/rfc7518/oct_key.py +++ b/authlib/jose/rfc7518/oct_key.py @@ -6,6 +6,16 @@ from ..rfc7517 import Key +POSSIBLE_UNSAFE_KEYS = ( + b"-----BEGIN ", + b"---- BEGIN ", + b"ssh-rsa ", + b"ssh-dss ", + b"ssh-ed25519 ", + b"ecdsa-sha2-", +) + + class OctKey(Key): """Key class of the ``oct`` key type.""" @@ -65,6 +75,11 @@ def import_key(cls, raw, options=None): key._dict_data = raw else: raw_key = to_bytes(raw) + + # security check + if raw_key.startswith(POSSIBLE_UNSAFE_KEYS): + raise ValueError("This key may not be safe to import") + key = cls(raw_key=raw_key, options=options) return key diff --git a/docs/changelog.rst b/docs/changelog.rst index 37faeb65..bd7892ec 100644 --- a/docs/changelog.rst +++ b/docs/changelog.rst @@ -6,6 +6,14 @@ Changelog Here you can see the full list of changes between each Authlib release. +Version 1.3.1 +------------- + +**Released on June 4, 2024** + +- Prevent ``OctKey`` to import ssh and PEM strings. + + Version 1.3.0 ------------- diff --git a/docs/conf.py b/docs/conf.py index a1cd9699..8ea1905e 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -36,7 +36,7 @@ html_favicon = '_static/icon.svg' html_theme_options = { "accent_color": "blue", - "og_image_url": "https://authlib.org/logo.png", + "og_image_url": 'https://authlib.org/logo.png', "light_logo": "_static/light-logo.svg", "dark_logo": "_static/dark-logo.svg", "twitter_site": "authlib", diff --git a/docs/requirements.txt b/docs/requirements.txt index cdf3ad8c..a04dd374 100644 --- a/docs/requirements.txt +++ b/docs/requirements.txt @@ -7,7 +7,7 @@ requests httpx>=0.18.2 starlette -sphinx==6.2.1 -sphinx-design==0.4.1 -sphinx-copybutton==0.5.2 +sphinx +sphinx-design +sphinx-copybutton shibuya