fix

Author: deatil

.github/workflows/test.yml

@@ -6,41 +6,51 @@ on:
   pull_request:
     branches: [ main ]
 
-permissions:
-    contents: write
-    packages: write
-
 jobs:
-  test:
+  test_only:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
 
       - name: Set timezone
         uses: szenius/set-timezone@v1.0
         with:
           timezoneLinux: "Asia/Shanghai"
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v2
         with:
-          go-version: 1.21
-
-      - name: Go mod tidy
-        run: go mod tidy
+          go-version: 1.25.0
 
       - name: Unit tests
-        run: go test -short -covermode=atomic -coverprofile=cover.out ./...
+        run: go test ./...
+
+  test_cover:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
 
-      - name: Test Generic
-        run: go test -short -tags=purego -covermode=atomic ./...
+      - name: Set timezone
+        uses: szenius/set-timezone@v1.0
+        with:
+          timezoneLinux: "Asia/Shanghai"
+
+      - name: Set up Go
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.26.4
+
+      - name: Unit tests
+        run: go test -coverprofile=cover.out ./...
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:

README.md

@@ -24,7 +24,7 @@ English | [中文](README_CN.md)
 
 ### Env
 
- - Go >= 1.20
+ - Go >= 1.25
 
 
 ### Download

README_CN.md

@@ -24,7 +24,7 @@ go-cryptobin 是一个简单易用并且兼容性高的 go 语言加密解密库
 
 ### 环境要求
 
- - Go >= 1.20
+ - Go >= 1.25
 
 
 ### 下载安装

SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you think you found a vulnerability, and even if you are not sure, please report it to [go-cryptobin issues](github.com/deatil/go-cryptobin/issues). Please try be explicit, describe steps to reproduce the security issue with code example(s).
+
+You will receive a response within a timely manner. If the issue is confirmed, we will do our best to release a patch as soon as possible given the complexity of the problem.
+
+## Public Discussions
+
+Please avoid publicly discussing a potential security vulnerability.
+
+Let's take this offline and find a solution first, this limits the potential impact as much as possible.
+
+We appreciate your help!

bencode/multiple_torrent.go

@@ -11,24 +11,24 @@ import (
 type MultipleTorrent struct {
     // `bencode:""`
     // tracker服务器的URL 字符串
-    Announce     string          `bencode:"announce"`
+    Announce     string       `bencode:"announce"`
     // 备用tracker服务器列表 列表
     // 发现 announce-list 后面跟了两个l(ll) announce-listll
-    AnnounceList [][]string      `bencode:"announce-list,omitempty"`
+    AnnounceList [][]string   `bencode:"announce-list,omitempty"`
     // 种子的创建时间 整数
-    CreatDate    int64           `bencode:"creation date"`
+    CreatDate    int64        `bencode:"creation date"`
     // 备注 字符串
-    Comment      string          `bencode:"comment"`
+    Comment      string       `bencode:"comment"`
     // 创建者 字符串
-    CreatedBy    string          `bencode:"created by"`
+    CreatedBy    string       `bencode:"created by"`
     // 详情
-    Info         MultipleInfo    `bencode:"info"`
+    Info         MultipleInfo `bencode:"info"`
     // 包含一系列ip和相应端口的列表，是用于连接DHT初始node
-    Nodes        [][]any         `bencode:"nodes,omitempty"`
+    Nodes        [][]any      `bencode:"nodes,omitempty"`
     // 文件的默认编码
-    Encoding     string          `bencode:"encoding,omitempty"`
+    Encoding     string       `bencode:"encoding,omitempty"`
     // 备注的utf-8编码
-    CommentUtf8  string          `bencode:"comment.utf-8,omitempty"`
+    CommentUtf8  string       `bencode:"comment.utf-8,omitempty"`
 }
 
 // 获取备用节点

bencode/single_torrent.go

@@ -89,8 +89,8 @@ type SingleInfo struct {
     PieceLength int    `bencode:"piece length"`
     Length      int    `bencode:"length"`
 
-    Name        string `bencode:"name"`
-    NameUtf8    string `bencode:"name.utf-8,omitempty"`
+    Name     string `bencode:"name"`
+    NameUtf8 string `bencode:"name.utf-8,omitempty"`
 
     // 文件发布者
     Publisher     string `bencode:"publisher,omitempty"`
@@ -100,8 +100,8 @@ type SingleInfo struct {
     PublisherUrl     string `bencode:"publisher-url,omitempty"`
     PublisherUrlUtf8 string `bencode:"publisher-url.utf-8,omitempty"`
 
-    MD5Sum           string `bencode:"md5sum,omitempty"`
-    Private          bool   `bencode:"private,omitempty"`
+    MD5Sum  string `bencode:"md5sum,omitempty"`
+    Private bool   `bencode:"private,omitempty"`
 }
 
 // 每个分片的 SHA-1 hash 长度是20 把他们从Pieces中切出来

go.mod

@@ -1,10 +1,10 @@
 module github.com/deatil/go-cryptobin
 
-go 1.20
+go 1.25.0
 
 require (
-	golang.org/x/crypto v0.31.0
-	golang.org/x/text v0.21.0
+	golang.org/x/crypto v0.53.0
+	golang.org/x/text v0.38.0
 )
 
-require golang.org/x/sys v0.28.0
+require golang.org/x/sys v0.46.0

go.sum

@@ -1,7 +1,8 @@
-golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=

pkcs12/p12_safebags.go

@@ -3,6 +3,7 @@ package pkcs12
 import (
     "io"
     "fmt"
+    "bytes"
     "errors"
     "encoding/pem"
     "encoding/asn1"
@@ -122,18 +123,39 @@ func (this *PKCS12) getSafeContents(p12Data, password []byte) (bags []SafeBag, u
         return nil, nil, err
     }
 
+    var authenticatedSafes []byte
+    if pfx.AuthSafe.Content.IsCompound {
+        var buf bytes.Buffer
+        authSafeBytes := pfx.AuthSafe.Content.Bytes
+
+        for {
+            var part []byte
+            authSafeBytes, _ = asn1.Unmarshal(authSafeBytes, &part)
+
+            buf.Write(part)
+
+            if authSafeBytes == nil {
+                break
+            }
+        }
+
+        authenticatedSafes = buf.Bytes()
+    } else {
+        authenticatedSafes = pfx.AuthSafe.Content.Bytes
+    }
+
     if len(pfx.MacData.Mac.Algorithm.Algorithm) == 0 {
         if !(len(password) == 2 && password[0] == 0 && password[1] == 0) {
             return nil, nil, errors.New("go-cryptobin/pkcs12: no MAC in data")
         }
     } else {
-        if err := pfx.MacData.Verify(pfx.AuthSafe.Content.Bytes, password); err != nil {
+        if err := pfx.MacData.Verify(authenticatedSafes, password); err != nil {
             if err == ErrIncorrectPassword && len(password) == 2 && password[0] == 0 && password[1] == 0 {
                 // some implementations use an empty byte array
                 // for the empty string password try one more
                 // time with empty-empty password
                 password = nil
-                err = pfx.MacData.Verify(pfx.AuthSafe.Content.Bytes, password)
+                err = pfx.MacData.Verify(authenticatedSafes, password)
             }
 
             if err != nil {
@@ -143,7 +165,7 @@ func (this *PKCS12) getSafeContents(p12Data, password []byte) (bags []SafeBag, u
     }
 
     var authenticatedSafe []ContentInfo
-    if err := unmarshal(pfx.AuthSafe.Content.Bytes, &authenticatedSafe); err != nil {
+    if err := unmarshal(authenticatedSafes, &authenticatedSafe); err != nil {
         return nil, nil, err
     }
 

rsa/equal_test.go

@@ -0,0 +1,51 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package rsa_test
+
+import (
+    "crypto"
+    "crypto/rand"
+    "crypto/rsa"
+    "crypto/x509"
+    "testing"
+)
+
+func TestEqual(t *testing.T) {
+    private, _ := rsa.GenerateKey(rand.Reader, 512)
+    public := &private.PublicKey
+
+    if !public.Equal(public) {
+        t.Errorf("public key is not equal to itself: %v", public)
+    }
+    if !public.Equal(crypto.Signer(private).Public().(*rsa.PublicKey)) {
+        t.Errorf("private.Public() is not Equal to public: %q", public)
+    }
+    if !private.Equal(private) {
+        t.Errorf("private key is not equal to itself: %v", private)
+    }
+
+    enc, err := x509.MarshalPKCS8PrivateKey(private)
+    if err != nil {
+        t.Fatal(err)
+    }
+    decoded, err := x509.ParsePKCS8PrivateKey(enc)
+    if err != nil {
+        t.Fatal(err)
+    }
+    if !public.Equal(decoded.(crypto.Signer).Public()) {
+        t.Errorf("public key is not equal to itself after decoding: %v", public)
+    }
+    if !private.Equal(decoded) {
+        t.Errorf("private key is not equal to itself after decoding: %v", private)
+    }
+
+    other, _ := rsa.GenerateKey(rand.Reader, 512)
+    if public.Equal(other.Public()) {
+        t.Errorf("different public keys are Equal")
+    }
+    if private.Equal(other) {
+        t.Errorf("different private keys are Equal")
+    }
+}