Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

fix(verify,runtime): reject private JWK members, non-canonical base64url, lone surrogates, duplicate JSON keys, and future revocation snapshots

Aperta
  • Qualcosa non va?
#267 5 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

  • #268 di @drk-ram — chiusa senza merge

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Ferma
Stack tecnologico
json, python
Ambito
backend, cryptography, security

Direzione di ricerca

Read the named entry points in src/ca2a_verify/dag.py, src/ca2a_runtime/agent_manifest.py, src/ca2a_runtime/canonical.py, src/ca2a_verify/verify.py, and src/ca2a_runtime/delegation/credential.py. Trace each boundary check and its existing tests, then add focused coverage for the listed malformed inputs and future timestamps. Done means all four cases are rejected with the specified errors; a pull request is already linked.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

needs-review:MEDIUM

What is wrong

In agentrust-io/ca2a on main, four related cryptographic and JSON/JCS boundary gaps exist across src/ca2a_verify/ and src/ca2a_runtime/:

  1. Private JWK parameters and non-canonical base64url keys are accepted in ca2a_verify/dag.py and ca2a_runtime/agent_manifest.py:

    • src/ca2a_verify/dag.py:_jwk_raw (lines 75-91) checks kty == "OKP" and crv == "Ed25519" and decodes x via base64.urlsafe_b64decode(value + "=" * (-len(value) % 4)).
    • It does not reject RFC 7517 / RFC 7518 / RFC 8037 private or symmetric key parameters (d, p, q, dp, dq, qi, oth, k — GHSA-vc4p-h84j-7qxj class), does not enforce canonical unpadded base64url (accepting =, +//, whitespace, and non-zero trailing bits), and does not require len(decoded) == 32.
    • src/ca2a_runtime/agent_manifest.py uses the same lenient urlsafe_b64decode helper.

  2. Lone UTF-16 surrogates in ca2a_runtime/canonical.py leak UnicodeEncodeError:

    • src/ca2a_runtime/canonical.py (lines 40-52, 94) appends lone UTF-16 surrogates (\ud800..\udfff) unescaped and calls .encode("utf-8"), raising a raw UnicodeEncodeError instead of a deterministic ValueError (matching RFC 8785 I-JSON rules).

  3. Duplicate JSON object keys are accepted in ca2a_verify/verify.py:

    • src/ca2a_verify/verify.py (lines 105-111, 135-141) loads chain and revocation JSON files with plain json.loads(...) without an object_pairs_hook, silently keeping only the last value when duplicate member names are present.

  4. Future-dated RevocationSnapshot.as_of bypasses max_revocation_staleness:

    • In src/ca2a_runtime/delegation/credential.py:381-389, staleness is checked via if max_staleness is not None and now - revocations.as_of > max_staleness: raise RevocationStatusUnknown(...). When revocations.as_of > now (a future-dated snapshot), now - revocations.as_of is negative and passes any max_staleness check indefinitely.

Expected behavior

  1. Reject any JWK carrying private key parameters (d, p, q, dp, dq, qi, oth, k) and enforce canonical unpadded 32-byte base64url in ca2a_verify/dag.py and ca2a_runtime/agent_manifest.py.
  2. Reject lone UTF-16 surrogates (U+D800..U+DFFF) in ca2a_runtime/canonical.py with a deterministic ValueError.
  3. Reject duplicate JSON keys in ca2a_verify/verify.py.
  4. Reject or flag RevocationSnapshot instances whose as_of is dated in the future relative to the evaluation time (as_of > now) with RevocationStatusUnknown.
Lingua principale
Python
Stelle
9
Fork
14
Merge medio
19h 54m
PR unite (30g)
47

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di agentrust-io/ca2a

Tutte le issue di agentrust-io/ca2a

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.