Skip to content

Commit

Permalink
[MGPG-116] Up max key file size to 64K (#85)
Browse files Browse the repository at this point in the history
Allow 64K files as well, as this may be "ring" (collection of keys) as well.

---

https://issues.apache.org/jira/browse/MGPG-116
  • Loading branch information
cstamas committed Mar 28, 2024
1 parent 944be4e commit ef57091
Showing 1 changed file with 8 additions and 3 deletions.
11 changes: 8 additions & 3 deletions src/main/java/org/apache/maven/plugins/gpg/BcSigner.java
Original file line number Diff line number Diff line change
Expand Up @@ -122,9 +122,14 @@ public byte[] loadKeyFingerprint(RepositorySystemSession session) {

public final class GpgConfLoader implements Loader {
/**
* Maximum key size, see <a href="https://wiki.gnupg.org/LargeKeys">Large Keys</a>.
* Maximum file size allowed to load (as we load it into heap).
* <p>
* This barrier exists to prevent us to load big/huge files, if this code is pointed at one
* (by mistake or by malicious intent).
*
* @see <a href="https://wiki.gnupg.org/LargeKeys">Large Keys</a>
*/
private static final long MAX_SIZE = 16 * 1024 + 1L;
private static final long MAX_SIZE = 64 * 1024 + 1L;

@Override
public byte[] loadKeyRingMaterial(RepositorySystemSession session) throws IOException {
Expand All @@ -138,7 +143,7 @@ public byte[] loadKeyRingMaterial(RepositorySystemSession session) throws IOExce
if (Files.size(keyPath) < MAX_SIZE) {
return Files.readAllBytes(keyPath);
} else {
throw new IOException("Refusing to load key " + keyPath + "; is larger than 16KB");
throw new IOException("Refusing to load file " + keyPath + "; is larger than 64KB");
}
}
return null;
Expand Down

0 comments on commit ef57091

Please sign in to comment.