Skip to content

Parser raises exception when encountering AEAD keys #79

Closed

Description

@mxsasha

The security.txt of werkenbijgroningen.nl causes an exception from PGPy that is not caught by sectxt.

NotImplementedError: <class 'pgpy.packet.types.Opaque'>
  File "celery/app/trace.py", line 760, in __protected_call__
    return self.run(*args, **kwargs)
  File "checks/tasks/appsecpriv.py", line 89, in web_appsecpriv
    return do_web_appsecpriv(af_ip_pairs, url, self, *args, **kwargs)
  File "checks/tasks/appsecpriv.py", line 245, in do_web_appsecpriv
    results[af_ip_pair[1]].update(securitytxt_check(af_ip_pair, url, task))
  File "checks/tasks/securitytxt.py", line 32, in securitytxt_check
    return _evaluate_securitytxt(result)
  File "checks/tasks/securitytxt.py", line 136, in _evaluate_securitytxt
    parser = sectxt.Parser(result.content, urls=result.found_url)
  File "__init__.py", line 93, in __init__
    self._process()
  File "__init__.py", line 100, in _process
    self._line_info.append(self._parse_line(line))
  File "__init__.py", line 165, in _parse_line
    pgpy.PGPMessage.from_blob(self._content_str)
  File "pgpy/types.py", line 195, in from_blob
    po = obj.parse(bytearray(blob, 'latin-1'))
  File "pgpy/pgp.py", line 1293, in parse
    self |= Packet(data)
  File "pgpy/pgp.py", line 1080, in __or__
    raise NotImplementedError(str(type(other)))

Probably the parser should accept this, even if PGPy can't fully validate it, possibly with a warning. It should definitely not raise the exception. Perhaps there are other PGPy exceptions that are not caught by the parser now.

See also:

Activity

  1. DigitalTrustCenter commented on Oct 28, 2024

    @DigitalTrustCenter
    Owner

    This issue was due to an incompatibility where the library PGPy is based on implements RFC 4880, which is now outdated by RFC 9580. Inputs formatted per the new RFC 9580 could cause a NotImplementedError.

    We have now updated sectxt to catch and ignore the NotImplementedError as it does not indicate a problem with the input itself. This is added in version 0.9.5. Additionally, we've forked the library causing the error, we could possible improve that library to include this functionality but the maintaining of the sectxt remains the main priority.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions