openwallet-foundation / acapy

Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments.
https://wiki.hyperledger.org/display/aries
Apache License 2.0
408 stars 512 forks source link

[BUG] - Invalid request validation while setting public did can lead to corrupt agent #3223

Open PatStLouis opened 1 month ago

PatStLouis commented 1 month ago

When creating a did with the sov method, it's possible to provide a did string. If you provide a did with more than 2 : delimiters, then promote this did to the public did, the agent won;t be able to restart as it's not parsing this input before sending it to indy-vdr for taa acceptence during startup process, resulting on failure to start.

To reproduce: Start an agent pointing to a ledger. Create a new did using the sov method and provide a did string, such as did:indy:bcovrin:test:<nym>. Once created, set this created did as the public did then restart the agent. If the agent had persitent memory, it should then become unable to start since it's blindly passing the did string to indy_vdr, which is treating the did as a did:sov. It will crash.

Few options:

swcurran commented 4 weeks ago

Related to/duplicate of #3224

PatStLouis commented 4 weeks ago

Somewhat related but the issue/result is different, definitely not a duplicate.