[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #18938 [Core Tor/Tor]: Authorities should reject non-ASCII content in ExtraInfo descriptors
#18938: Authorities should reject non-ASCII content in ExtraInfo descriptors
------------------------------+--------------------------
Reporter: teor | Owner:
Type: defect | Status: new
Priority: Medium | Milestone: Tor: 0.2.???
Component: Core Tor/Tor | Version:
Severity: Normal | Keywords: 029-proposed
Actual Points: | Parent ID: #18656
Points: small | Reviewer:
Sponsor: |
------------------------------+--------------------------
In #18656, we discovered that authorities don't validate that ExtraInfo
descriptors are printable ASCII before accepting them.
Authorities (and HSDirs) should check every directory document they
receive consists only of "printing ASCII", as defined in torspec:
{{{
NL = The ascii LF character (hex value 0x0a).
KeywordChar ::= 'A' ... 'Z' | 'a' ... 'z' | '0' ... '9' | '-'
ArgumentChar ::= any printing ASCII character except NL.
WS = (SP | TAB)+
}}}
I've heard others say that the following lines allow non-ASCII content,
but I'm not sure if that's actually the case, and if it is, how many
relays this would affect:
* the "platform" line in relay descriptors, which is a "human-readable
string",
* the contact "info" line in relay descriptors, which has an undefined
format.
If it is, I'd recommend we make them all ASCII for consistency, and update
torspec to clarify, and include it as a "major" change in an 0.2.x tor
release.
(This means that some users will be unable to spell their names correctly.
But there was never any guarantee that 8-bit characters in "info" would be
interpreted as users intended. I think security is more important here.)
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18938>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs