-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Improve input validation to support Unicode/utf-8 charsets #1001
Comments
The clean function can be removed. This will solve internationalization for word lists. clean is only called in crypto_util.py -- it is called twice. scrypt.hash in Python 2 needs str() type. This is easy: http://stackoverflow.com/a/1207836 The clean function does manage conversion from unicode to string, so this must be added elsewhere. Not sure what happens with the error handling for CryptoError now, but this raise should minimally be preserved or removed. ###Security This is not a huge deal because: |
This is still a valid issue, and we should resolve in order to address #999. |
The |
Thanks @nabla-c0d3! It looks like we're still doing character validation against a limited character set in a different function now. https://github.com/freedomofpress/securedrop/blob/develop/securedrop/crypto_util.py#L41-L42 Therefore keeping this issue open. |
Currently, input validation only supports ascii chars, e.g.:
As part of developing i18n support for SecureDrop, the crypto_util.py
clean
function should be updated to sanitize Unicode/utf-8 input.This is important for two reasons:
The text was updated successfully, but these errors were encountered: