Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[MGPG-116] Up max key file size to 64K #85

Merged
merged 3 commits into from
Mar 28, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 8 additions & 3 deletions src/main/java/org/apache/maven/plugins/gpg/BcSigner.java
Original file line number Diff line number Diff line change
Expand Up @@ -122,9 +122,14 @@ public byte[] loadKeyFingerprint(RepositorySystemSession session) {

public final class GpgConfLoader implements Loader {
/**
* Maximum key size, see <a href="https://wiki.gnupg.org/LargeKeys">Large Keys</a>.
* Maximum file size allowed to load (as we load it into heap).
* <p>
* This barrier exists to prevent us to load big/huge files, if this code is pointed at one
* (by mistake or by malicious intent).
*
* @see <a href="https://wiki.gnupg.org/LargeKeys">Large Keys</a>
*/
private static final long MAX_SIZE = 16 * 1024 + 1L;
private static final long MAX_SIZE = 64 * 1024 + 1L;

@Override
public byte[] loadKeyRingMaterial(RepositorySystemSession session) throws IOException {
Expand All @@ -138,7 +143,7 @@ public byte[] loadKeyRingMaterial(RepositorySystemSession session) throws IOExce
if (Files.size(keyPath) < MAX_SIZE) {
return Files.readAllBytes(keyPath);
} else {
throw new IOException("Refusing to load key " + keyPath + "; is larger than 16KB");
throw new IOException("Refusing to load file " + keyPath + "; is larger than 64KB");
}
}
return null;
Expand Down