From f9c85351f3946f585da9401b29ced88c7726265d Mon Sep 17 00:00:00 2001 From: Seongmin Lee Date: Mon, 18 May 2026 06:08:00 +0000 Subject: [PATCH] keyfetch: ignore invalid ssh keys and strip out remaining bytes Signed-off-by: Seongmin Lee --- keyfetch/keyfetch.go | 9 ++++++++- 1 file(s) changed, 8 insertion(s)(+), 1 deletion(s)(-) diff --git a/keyfetch/keyfetch.go b/keyfetch/keyfetch.go --- a/keyfetch/keyfetch.go +++ b/keyfetch/keyfetch.go @@ -10,6 +10,7 @@ "strings" "github.com/urfave/cli/v3" + "golang.org/x/crypto/ssh" "tangled.org/core/log" ) @@ -113,9 +114,15 @@ func formatKeyData(executablePath, gitDir, logPath, endpoint string, data []map[string]any) string { var result string for _, entry := range data { + raw, _ := entry["key"].(string) + key, _, _, _, err := ssh.ParseAuthorizedKey([]byte(raw)) + if err != nil { + continue + } result += fmt.Sprintf( `command="%s guard -git-dir %s -user %s -log-path %s -internal-api %s",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty %s`+"\n", - executablePath, gitDir, entry["did"], logPath, endpoint, entry["key"]) + executablePath, gitDir, entry["did"], logPath, endpoint, ssh.MarshalAuthorizedKey(key)) } return result } + -- tangled.sh