Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Example: Unpack Base64 using 'm0*' rather than 'm*'
`unpack('m*')` ignores non-Base-64 characters; `unpack('m0*')` raises an exception `ArgumentError: invalid base64` on encountering an invalid character. The former follows [RFC 2046 §6.8], "Any characters outside of the base64 alphabet are to be ignored in base64-encoded data." That has been superseded by [RFC 4648 §3.3] which points out that this introduces security and other issues, and says "Implementations MUST reject the encoded data if it contains characters outside the base alphabet when interpreting base-encoded data, unless the specification referring to this document explicitly states otherwise." Potential security issues aside, it's clear that here it's better to require a Base 64 string with no invalid characters so that the caller finds it easier to diagnose errors in the parameters. We change it here to provide a better example to other implementors of this idea who may be copying the code. There's a good argument to be made that we shouldn't be including the "type" (i.e., `ssh-rsa` or whatever) at all at the start of the hostkey parameter as it's not actually used by the underlying Net::SSH code. This will be dealt with in a later commit. [RFC 2046 §6.8]: https://tools.ietf.org/html/rfc2045#section-6.8 [RFC 4648 §3.3]: https://tools.ietf.org/html/rfc4648#section-3.3
- Loading branch information