Elgato_dark/python-tuf
1
0
Fork 0
mirror of https://github.com/theupdateframework/python-tuf synced 2026-05-24 10:08:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Partial remedy for #26, #33 (expected vs actual data length).

Browse source 
Do not wish to risk breaking tuf.client.updater at this point,
where the fault lies because metadata metadata is not checked.

We are aware of #26 and #33, and actively working to fix them.
This commit is contained in:
dachshund 2013-03-13 01:03:00 -04:00
parent 1db02d47b3
commit 384c656ef7
1 changed files with 25 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
tuf/download.py
View file

@ -284,8 +284,31 @@ def download_url_to_tempfileobj(url, required_hashes=None, required_length=None)
try:
# info().get('Content-Length') gets the length of the url file.
file_length = int(connection.info().get('Content-Length'))
file_length = connection.info().get('Content-Length')
# If the HTTP server did not specify a Content-Length...
if file_length is None:
# Do we know what is the required_length for this file?
if required_length is None:
# No, we do not know this. Raise this to the user!
message = 'Do not know anything about how much to download for "' + url + '"!'
raise tuf.DownloadError(message)
else:
# Okay, the HTTP server has not told us the Content-Length,
# but we know how much we are required to download.
file_length = required_length
else:
# Do we know what is the required_length for this file?
if required_length is None:
# No, we do not know this. Avoid falling for an arbitrary-length data attack.
# FIXME: https://github.com/akonst/tuf/issues/26
message = 'Do not know how much is required to download for "' + url + '"!'
logger.debug(message)
file_length = int(file_length, 10)
else:
# Okay, we do know this. Go ahead with checks.
file_length = int(file_length, 10)
# Does the url's 'file_length' match 'required_length'?
if required_length is not None and file_length != required_length:
message = 'Incorrect length for '+url+'. Expected '+str(required_length)+ \