From f21eec6c862970d8f031fecfd6cefe5f0cd87f10 Mon Sep 17 00:00:00 2001 From: tomaioo Date: Sat, 11 Apr 2026 07:15:05 +0700 Subject: [PATCH] fix(security): panic on malformed hex input in signature verifica `verify_signature` slices `public_key_hex[i..i + 2]` without validating that the input length is even. An odd-length or otherwise malformed string can trigger an out-of-bounds panic, which may crash the process (or at minimum terminate the request path), creating a denial-of-service vector if this method is reachable from untrusted input. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- rust/crates/openjarvis-python/src/skills.rs | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/rust/crates/openjarvis-python/src/skills.rs b/rust/crates/openjarvis-python/src/skills.rs index b228c9e2..7f9cea4a 100644 --- a/rust/crates/openjarvis-python/src/skills.rs +++ b/rust/crates/openjarvis-python/src/skills.rs @@ -48,10 +48,18 @@ impl PySkillManifest { } fn verify_signature(&self, public_key_hex: &str) -> bool { - let key_bytes: Vec = (0..public_key_hex.len()) - .step_by(2) - .filter_map(|i| u8::from_str_radix(&public_key_hex[i..i + 2], 16).ok()) - .collect(); + if public_key_hex.len() % 2 != 0 { + return false; + } + + let mut key_bytes = Vec::with_capacity(public_key_hex.len() / 2); + for i in (0..public_key_hex.len()).step_by(2) { + match u8::from_str_radix(&public_key_hex[i..i + 2], 16) { + Ok(byte) => key_bytes.push(byte), + Err(_) => return false, + } + } + openjarvis_skills::verify_signature(&self.inner, &key_bytes) } }