diff options
| author | nekrondev <heiko@noordsee.de> | 2023-12-14 03:39:32 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-12-14 02:39:32 +0000 |
| commit | 52046b934dc619665bc51a59ad5ff9092fab118e (patch) | |
| tree | 8ae05466d692fd6d71181d4b89aac829010c0d4f /models | |
| parent | cbf923e87bca0f50c2c01a60ccf544b63c365e98 (diff) | |
| download | gitea-52046b934dc619665bc51a59ad5ff9092fab118e.tar.gz gitea-52046b934dc619665bc51a59ad5ff9092fab118e.zip | |
Retry SSH key verification with additional CRLF if it failed (#28392)
Windows-based shells will add a CRLF when piping the token into
ssh-keygen command resulting in
verification error. This resolves #21527.
---------
Co-authored-by: Heiko Besemann <heiko.besemann@qbeyond.de>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Diffstat (limited to 'models')
| -rw-r--r-- | models/asymkey/ssh_key_verify.go | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/models/asymkey/ssh_key_verify.go b/models/asymkey/ssh_key_verify.go index e9f433248a..208288c77b 100644 --- a/models/asymkey/ssh_key_verify.go +++ b/models/asymkey/ssh_key_verify.go @@ -30,10 +30,15 @@ func VerifySSHKey(ctx context.Context, ownerID int64, fingerprint, token, signat return "", ErrKeyNotExist{} } - if err := sshsig.Verify(bytes.NewBuffer([]byte(token)), []byte(signature), []byte(key.Content), "gitea"); err != nil { - log.Error("Unable to validate token signature. Error: %v", err) - return "", ErrSSHInvalidTokenSignature{ - Fingerprint: key.Fingerprint, + err = sshsig.Verify(bytes.NewBuffer([]byte(token)), []byte(signature), []byte(key.Content), "gitea") + if err != nil { + // edge case for Windows based shells that will add CR LF if piped to ssh-keygen command + // see https://github.com/PowerShell/PowerShell/issues/5974 + if sshsig.Verify(bytes.NewBuffer([]byte(token+"\r\n")), []byte(signature), []byte(key.Content), "gitea") != nil { + log.Error("Unable to validate token signature. Error: %v", err) + return "", ErrSSHInvalidTokenSignature{ + Fingerprint: key.Fingerprint, + } } } |