altf4arnold/datatracker
1
0
Fork 0
Code Issues Pull requests Actions 3 Packages Projects Releases Wiki Activity

Added a catch for malformed apikey input.

Browse source 
- Legacy-Id: 17769
This commit is contained in:
Henrik Levkowetz 2020-05-10 14:16:22 +00:00
parent 02804ba163
commit 26e85ce53b
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ietf/person/models.py
View file

@ -351,7 +351,10 @@ class PersonalApiKey(models.Model):
def validate_key(cls, s): def validate_key(cls, s):
import struct, hashlib, base64 import struct, hashlib, base64
assert isinstance(s, bytes) assert isinstance(s, bytes)
key = base64.urlsafe_b64decode(s) try:
key = base64.urlsafe_b64decode(s)
except Exception:
return None
id, salt, hash = struct.unpack(KEY_STRUCT, key) id, salt, hash = struct.unpack(KEY_STRUCT, key)
k = cls.objects.filter(id=id) k = cls.objects.filter(id=id)
if not k.exists(): if not k.exists():