WolfSSL
/
wolfcrypt-jni
mirror of https://github.com/wolfSSL/wolfcrypt-jni.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-4362: escape CR and LF in wolfJCE debug log messages

pull/261/head
Chris Conlon 2026-08-18 16:40:57 -06:00
parent 58df604f13
commit 25b4ceb8cf
2 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/main/java/com/wolfssl/provider/jce/WolfCryptDebug.java
View File

@ -120,6 +120,10 @@ class WolfCryptDebug {
if (message == null) {
message = "";
}
else {
/* Escape CR and LF */
message = message.replace("\r", "\\r").replace("\n", "\\n");
}
return String.format("%s [%s %s: TID %d: %s] %s\n",
TimeFormatter.format(

26
src/test/java/com/wolfssl/provider/jce/test/WolfSSLKeyStoreTest.java
View File

@ -75,6 +75,7 @@ import java.security.spec.X509EncodedKeySpec;
import java.security.spec.InvalidKeySpecException;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;
@ -415,6 +416,31 @@ public class WolfSSLKeyStoreTest {
}
}
@Test
public void testAliasWithLineBreaksRoundTrips() throws Exception {
/* Line breaks in an alias are escaped in debug log output only,
* the alias itself must round trip through store/load unchanged */
String alias = "evil\nalias\rwith\r\nline breaks";
KeyStore store = KeyStore.getInstance("WKS", "wolfJCE");
store.load(null, storePass.toCharArray());
store.setKeyEntry(alias, new SecretKeySpec(new byte[16], "AES"),
storePass.toCharArray(), null);
ByteArrayOutputStream bos = new ByteArrayOutputStream();
store.store(bos, storePass.toCharArray());
KeyStore reloaded = KeyStore.getInstance("WKS", "wolfJCE");
reloaded.load(new ByteArrayInputStream(bos.toByteArray()),
storePass.toCharArray());
assertTrue("alias with line breaks must round trip unchanged",
reloaded.containsAlias(alias));
assertNotNull("key must be retrievable at original alias",
reloaded.getKey(alias, storePass.toCharArray()));
}
/**
* A crafted WKS stream with an oversized encoded entry length must be
* rejected with an IOException, not trigger an unbounded allocation.