fix(base64): Reject too-short encodings

endojs / endo

Endo is a distributed secure JavaScript sandbox, based on SES

Apache License 2.0

804 stars 71 forks source link

fix(base64): Reject too-short encodings #1991

Closed gibson042 closed 7 months ago

gibson042 commented 8 months ago

Fixes #1990

Description

Test invalid encodings, and reject input that is too short.

Security Considerations

None known.

Scaling Considerations

n/a

Documentation Considerations

Should this have a CHANGELOG entry?

Testing Considerations

New and improved!

Upgrade Considerations

n/a

kriskowal commented 8 months ago

With this change, do we accept all strings we previously generated? That is, do we generate the appropriate padding in all cases?

gibson042 commented 8 months ago

Yes, the generation code already correctly outputs padding.

gibson042 commented 8 months ago

@kriskowal This is good without a CHANGELOG.md entry, right?

kriskowal commented 7 months ago

@kriskowal This is good without a CHANGELOG.md entry, right?

This is fine without a NEWS.md entry (CHANGELOG.md gets generated from commit messages at time of release.)

I prefer (and do not insist) on redundantly capturing messages to upgraders in NEWS.md if the dependant package needs to make some changes to compensate for an upgrade. Like, if a method is deprecated, there should be a recommendation to use a different equivalent behavior (or stop that). Likewise for removal of deprecated methods.