Skip to content

Commit

Permalink
Fix newline bug by escaping LF and CR in message
Browse files Browse the repository at this point in the history
in-toto has new error messages that contain newline characters.
When relaying these messages to apt the text-based protocol breaks.
We fix this by escaping any newline character in the message.

NOTE: The apt method interface spec references RFC822, which
doesn't allow LF or CR in the message body, except if followed by a
LWSP-char (i.e. SPACE or HTAB, for "folding" of long lines). But
apt does not seem to support folding, and splits lines only at LF.
To be safe we escape LF and CR.  See 2.1 Overview in
www.fifi.org/doc/libapt-pkg-doc/method.html/ch2.html See "3.1.1.
LONG HEADER FIELDS" and  "3.1.2. STRUCTURE OF HEADER FIELDS" in
www.ietf.org/rfc/rfc822.txt
  • Loading branch information
lukpueh committed May 16, 2019
1 parent bce4593 commit 7decd62
Showing 1 changed file with 10 additions and 0 deletions.
10 changes: 10 additions & 0 deletions intoto.py
Original file line number Diff line number Diff line change
Expand Up @@ -423,6 +423,16 @@ def write_one(message_str, stream):


def notify_apt(code, message_text, uri):
# Escape LF and CR characters in message bodies to not break the protocol
message_text = message_text.replace("\n", "\\n").replace("\r", "\\r")
# NOTE: The apt method interface spec references RFC822, which doesn't allow
# LF or CR in the message body, except if followed by a LWSP-char (i.e. SPACE
# or HTAB, for "folding" of long lines). But apt does not seem to support
# folding, and splits lines only at LF. To be safe we escape LF and CR.
# See 2.1 Overview in www.fifi.org/doc/libapt-pkg-doc/method.html/ch2.html
# See "3.1.1. LONG HEADER FIELDS" and "3.1.2. STRUCTURE OF HEADER FIELDS" in
# www.ietf.org/rfc/rfc822.txt

write_one(serialize_one({
"code": code,
"info": MESSAGE_TYPE[code]["info"],
Expand Down

0 comments on commit 7decd62

Please sign in to comment.