Bug 1643292 - Add a size limitation for OpenPGP key import. r=PatrickBrunschwig a=wsmwk
authorKai Engert <kaie@kuix.de>
Thu, 04 Jun 2020 14:34:50 +0200
changeset 39394 ab075b833c0ff991c1930bd40c4d8fc5180386db
parent 39393 1a3ece9ab4905766239ca9a9b3e6e20284632ff3
child 39395 abe3463441023c7eeb1cbd5929eaeb6a89b11f2d
push id402
push userclokep@gmail.com
push dateMon, 29 Jun 2020 20:48:04 +0000
reviewersPatrickBrunschwig, wsmwk
bugs1643292
Bug 1643292 - Add a size limitation for OpenPGP key import. r=PatrickBrunschwig a=wsmwk Differential Revision: https://phabricator.services.mozilla.com/D78266
mail/extensions/openpgp/content/modules/RNP.jsm
mail/extensions/openpgp/content/modules/autocrypt.jsm
mail/extensions/openpgp/content/strings/enigmail.properties
mail/extensions/openpgp/content/ui/commonWorkflows.js
--- a/mail/extensions/openpgp/content/modules/RNP.jsm
+++ b/mail/extensions/openpgp/content/modules/RNP.jsm
@@ -1173,17 +1173,23 @@ var RNP = {
     }
 
     RNPLib.rnp_buffer_destroy(jsonInfo);
     RNPLib.rnp_input_destroy(input_from_memory);
 
     return rv;
   },
 
+  maxImportKeyBlockSize: 5000000,
+
   async getKeyListFromKeyBlock(keyBlockStr, pubkey = true, seckey = false) {
+    if (keyBlockStr.length > RNP.maxImportKeyBlockSize) {
+      throw new Error("rejecting big keyblock");
+    }
+
     let tempFFI = new RNPLib.rnp_ffi_t();
     if (RNPLib.rnp_ffi_create(tempFFI.address(), "GPG", "GPG")) {
       throw new Error("Couldn't initialize librnp.");
     }
 
     let keyList = null;
     if (!this.importToFFI(tempFFI, keyBlockStr, pubkey, seckey)) {
       keyList = await this.getKeysFromFFI(tempFFI, true);
@@ -1196,16 +1202,20 @@ var RNP = {
   async importKeyBlock(
     win,
     passCB,
     keyBlockStr,
     pubkey,
     seckey,
     password = null
   ) {
+    if (keyBlockStr.length > RNP.maxImportKeyBlockSize) {
+      throw new Error("rejecting big keyblock");
+    }
+
     /*
      * Import strategy:
      * - import file into a temporary space, in-memory only (ffi)
      * - if we failed to decrypt the secret keys, return null
      * - change the password of all secret keys
      * - get the key listing of all keys from the temporary space,
      *   which is want we want to return as the import report
      * - export all keys from the temporary space, and import them
--- a/mail/extensions/openpgp/content/modules/autocrypt.jsm
+++ b/mail/extensions/openpgp/content/modules/autocrypt.jsm
@@ -409,16 +409,17 @@ var EnigmailAutocrypt = {
     let keysObj = {};
     let importedKeys = [];
 
     // TODO: need a MPL version of bytesToArmor
     let pubkey = EnigmailOpenPGP.enigmailFuncs.bytesToArmor(
       EnigmailOpenPGP.armor.public_key,
       keyData
     );
+    // TODO: respect pubkey size limitation
     await EnigmailKeyRing.importKeyAsync(null, false, pubkey, false, "", {}, keysObj);
 
     if (keysObj.value) {
       importedKeys = importedKeys.concat(keysObj.value);
 
       if (keysObj.value.length > 0) {
         let key = EnigmailKeyRing.getKeyById(keysObj.value[0]);
 
--- a/mail/extensions/openpgp/content/strings/enigmail.properties
+++ b/mail/extensions/openpgp/content/strings/enigmail.properties
@@ -623,8 +623,13 @@ import.secretKeyImportError=An error has
 
 #strings in importSettings.js
 importSettings.errorNoFile=The file you specified is not a regular file!
 importSettings.cancelWhileInProgress=Restoring is in progress. Do you really want to abort the process?
 importSettings.button.abortImport=&Abort process
 
 cannotUseOwnKeyBecause=Unable to send the message, because there is a problem with your personal key. %S
 cannotEncryptBecauseMissing=Unable to send this message with end-to-end encryption, because there are problems with the keys of the following recipients: %S
+
+
+
+
+fileToBigToImport=This file is too big. Please don't import a large set of keys at once.
--- a/mail/extensions/openpgp/content/ui/commonWorkflows.js
+++ b/mail/extensions/openpgp/content/ui/commonWorkflows.js
@@ -59,16 +59,23 @@ function EnigmailCommon_importKeysFromFi
     "*.asc",
     "",
     [EnigmailLocale.getString("gnupgFile"), "*.asc;*.gpg;*.pgp"]
   );
   if (!inFile) {
     return false;
   }
 
+  // infile type: nsIFile
+  // RNP.maxImportKeyBlockSize
+  if (inFile.fileSize > 5000000) {
+    EnigmailDialog.alert(window, EnigmailLocale.getString("fileToBigToImport"));
+    return false;
+  }
+
   let errorMsgObj = {};
   // preview
   let preview = EnigmailKey.getKeyListFromKeyFile(
     inFile,
     errorMsgObj,
     !secret,
     secret
   );