Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

crypto: only partial validation of Hash argument in RegisterHash #60548

Open
Baselkh opened this issue Jun 1, 2023 · 1 comment
Open

crypto: only partial validation of Hash argument in RegisterHash #60548

Baselkh opened this issue Jun 1, 2023 · 1 comment
Labels
NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone

Comments

@Baselkh
Copy link

Baselkh commented Jun 1, 2023

What version of Go are you using (go version)?

$ go version
go version go1.19.1 darwin/amd64
# but please note that it's not relevant, since I'm providing references and links to go1.20.4 below.

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output
$ go env
GOARCH="amd64"
GOOS="darwin"
# other values are irrelevant in this case

What did you do?

Browsing src/crypto/crypto.go, I've noticed that RegisterHash doesn't not validate the Hash argument in the same fashion as the rest of the package.

What did you expect to see?

I expected RegisterHash to validate that the Hash argument is bigger than 0, as the smallest Hash value defined in the package is uint 1 (MD4, which is defined with 1 + iota).
I though that it might be there for a legit use ...

What did you see instead?

Digging in a bit more, and trying to find an explanation or a legit use, I failed, leading me to believe that it's not intentional.
I might be wrong, since I'm not super experienced with the package, but I expect to see a comment addressing the exceptional check if it was by design.

@mknyszek mknyszek changed the title daffected/package: partial validation of Hash argument in RegisterHash (src/crypto/crypto.go) crypto: only partial validation of Hash argument in RegisterHash Jun 1, 2023
@mknyszek
Copy link
Contributor

mknyszek commented Jun 1, 2023

CC @golang/security

@mknyszek mknyszek added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jun 1, 2023
@mknyszek mknyszek added this to the Backlog milestone Jun 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Development

No branches or pull requests

2 participants