Elgato_dark/python-tuf
1
0
Fork 0
mirror of https://github.com/theupdateframework/python-tuf synced 2026-05-24 10:08:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
python-tuf/tuf/ngclient
History
Jussi Kukkonen 94ed456b05 ngclient: Encode rolenames when using as filenames 
If an attacker manages to create arbitrary rolenames they could trick
the client into writing metadata files into unexpected locations:
To avoid directory traversal and writing files into unexpected
locations, encode the rolename before using it as filename.

If a client has delegated targets metadata with rolenames that have
percent-encoded characters in them, these metadata will now not be
found in local metadata cache and must be re-downloaded.

Note that this does not mean using rolenames that get encoded is
advisable (as forming the download URLs still has issues with them),
this just means the client will not do unsafe writes when it encounters
rolenames like this.

Signed-off-by: Jussi Kukkonen <jkukkonen@vmware.com>
2021-10-13 15:47:58 +03:00
..
_internal Introduce the idea of trusted/untrusted snapshot 2021-10-13 10:40:28 +03:00
__init__.py Add client config module 2021-07-05 18:35:32 +03:00
config.py ngclient: Fix docs link to specification 2021-10-01 14:42:54 +03:00
fetcher.py Remove max_length parameter from fetch 2021-08-30 15:29:14 +03:00
README.md Improve README 2021-07-05 10:45:19 +03:00
updater.py ngclient: Encode rolenames when using as filenames 2021-10-13 15:47:58 +03:00

README.md

Next-gen TUF client for Python

This package provides modules for TUF client implementers.

tuf.ngclient.Updater is a class that implements the client workflow described in the TUF specification (see https://theupdateframework.github.io/specification/latest/#detailed-client-workflow)

tuf.ngclient.FetcherInterface is an abstract class that client implementers can implement a concrete class of in order to reuse their own networking/download libraries -- a Requests-based implementation is used by default.

This package:

  • Aims to be a clean, easy-to-validate reference client implementation written in modern Python
  • At the same time aims to be the library of choice for anyone implementing a TUF client in Python: light-weight, easy to integrate and with minimal required dependencies
  • Is still under development but is planned to become the default client in this implementation (i.e., the older tuf.client will be deprecated in the future)