cotugno/conduit
2
Fork 0
mirror of https://gitlab.com/famedly/conduit.git synced 2024-11-16 18:28:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'm0dex/fix-signature-upload' into 'next'

Browse Source 
fix(client/keys): ignore all but signed keys in signature upload route

See merge request famedly/conduit!378
This commit is contained in:
Timo Kösters 2022-08-14 19:31:46 +00:00 committed by Nyaaori
commit c2a5315e9f
No known key found for this signature in database
GPG Key ID: E7819C3ED4D1F82E
1 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/api/client_server/keys.rs
View File

@ -148,11 +148,24 @@ pub async fn upload_signatures_route(
) -> Result<upload_signatures::v3::Response> {
let sender_user = body.sender_user.as_ref().expect("user is authenticated");
for (user_id, signed_keys) in &body.signed_keys {
for (key_id, signed_key) in signed_keys {
let signed_key = serde_json::to_value(signed_key).unwrap();
for (user_id, keys) in &body.signed_keys {
for (key_id, key) in keys {
let key = serde_json::to_value(key)
.map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "Invalid key JSON"))?;
for signature in signed_key
let is_signed_key = match key.get("usage") {
Some(usage) => usage
.as_array()
.map(|usage| !usage.contains(&json!("master")))
.unwrap_or(false),
None => true,
};
if !is_signed_key {
continue;
}
for signature in key
.get("signatures")
.ok_or(Error::BadRequest(
ErrorKind::InvalidParam,