Karl/BobStore
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added test of "Master Key"-style exploit based

Browse Source 
This does not seem affected, I made a quick and dirty zip with two
index.xml files in it following these instructions:
http://www.saurik.com/id/17

refs #39 https://gitlab.com/fdroid/fdroidclient/issues/39
This commit is contained in:
Hans-Christoph Steiner 2014-06-11 22:01:06 -04:00
parent 8af69afba6
commit 3fef37a5f4
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
test/assets/masterKeyIndex.jar Normal file
View File

Binary file not shown.

20
test/src/org/fdroid/fdroid/updater/SignedRepoUpdaterTest.java
View File

@ -12,7 +12,11 @@ import org.fdroid.fdroid.Utils;
import org.fdroid.fdroid.data.Repo;
import org.fdroid.fdroid.updater.RepoUpdater.UpdateException;
import java.io.*;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
@TargetApi(8)
public class SignedRepoUpdaterTest extends InstrumentationTestCase {
@ -165,4 +169,18 @@ public class SignedRepoUpdaterTest extends InstrumentationTestCase {
// success!
}
}
public void testExtractIndexFromMasterKeyIndexJar() {
if (!testFilesDir.canWrite())
return;
// this is supposed to fail
try {
repoUpdater.getIndexFromFile(getTestFile("masterKeyIndex.jar"));
fail();
} catch (UpdateException e) {
// success!
} catch (SecurityException e) {
// success!
}
}
}