From 16a7c7b8d71a2fe357543749261696838c50a8db Mon Sep 17 00:00:00 2001 From: Leonard Lyubich Date: Tue, 19 Nov 2024 15:29:15 +0300 Subject: [PATCH] session: Prevent panic of `AssertAuthKey` method on nil public key Although nil key can be caught by the caller, lib-side NPE is still bad in this case. Signed-off-by: Leonard Lyubich --- session/common.go | 5 +++-- session/common_test.go | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/session/common.go b/session/common.go index f40a4610..643dcf45 100644 --- a/session/common.go +++ b/session/common.go @@ -330,13 +330,14 @@ func (x *commonData) SetIssuer(id user.ID) { x.issuer = id } -// AssertAuthKey asserts public key bound to the session. +// AssertAuthKey asserts public key bound to the session. The key should not be +// nil. // // Zero session fails the check. // // See also SetAuthKey. func (x commonData) AssertAuthKey(key neofscrypto.PublicKey) bool { - return bytes.Equal(neofscrypto.PublicKeyBytes(key), x.authKey) + return key != nil && bytes.Equal(neofscrypto.PublicKeyBytes(key), x.authKey) } // Issuer returns user ID of the session issuer. diff --git a/session/common_test.go b/session/common_test.go index 923ac2f5..b7e101b3 100644 --- a/session/common_test.go +++ b/session/common_test.go @@ -266,6 +266,7 @@ func testSetAuthKey[T session.Container | session.Object](t testing.TB, set func k1 := neofscryptotest.Signer().Public() k2 := neofscryptotest.Signer().Public() var x T + require.False(t, assert(x, nil)) require.False(t, assert(x, k1)) require.False(t, assert(x, k2))