Skip to content

Commit

Permalink
Handle overlong icon values
Browse files Browse the repository at this point in the history
We skip the icon field during deserialization if it is too long.
Previously, we directly tried to deserialize a String<N> and ignored any
errors.  This means that we also ignored any other errors, e. g. for
invalid data types.

This patch changes the implementation to first deserialize a string
slice and handle errors occuring during the deserialization.  Then we
check if the string slice fits into String<N> or if we should ignore the
value.
  • Loading branch information
robin-nitrokey committed Feb 19, 2024
1 parent 084db87 commit 01099c4
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions src/webauthn.rs
Original file line number Diff line number Diff line change
Expand Up @@ -71,8 +71,10 @@ fn deserialize_from_str_and_skip_if_too_long<'de, D, const L: usize>(
where
D: serde::Deserializer<'de>,
{
let result: Result<String<L>, D::Error> = serde::Deserialize::deserialize(deserializer);
match result {
let s: &'de str = Deserialize::deserialize(deserializer)?;
// String::from(s) could panic and is not really infallibe. It is removed in heapless 0.8.
#[allow(clippy::unnecessary_fallible_conversions)]
match String::try_from(s) {
Ok(string) => Ok(Some(string)),
Err(_err) => {
info_now!("skipping field: {:?}", _err);
Expand Down

0 comments on commit 01099c4

Please sign in to comment.