Skip to content

Change signature validation logic to call first without the file content #14849

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adityapatwardhan merged 5 commits into from
Feb 23, 2021
Merged

Change signature validation logic to call first without the file content #14849

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
008e2e9
Change signature validation logic to call first without the file cont…
JamesWTruher Feb 19, 2021
f9bb569
remove extraneous extra line
JamesWTruher Feb 19, 2021
c43b472
Update src/System.Management.Automation/security/SecurityManager.cs
TravisEz13 Feb 19, 2021
72e4cd1
use system.text namespace
JamesWTruher Feb 19, 2021
113064a
Update src/System.Management.Automation/security/SecurityManager.cs
JamesWTruher Feb 22, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 18 additions & 4 deletions src/System.Management.Automation/security/SecurityManager.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
using System.Management.Automation.Security;
using System.Security;
using System.Security.Cryptography.X509Certificates;
using System.Text;

using Dbg = System.Management.Automation;

Expand Down Expand Up @@ -516,15 +517,28 @@ private static void UntrustPublisher(Signature signature)
}
}

// Check the signature via the SIP which should never erroneously validate an invalid signature
// or altered script.
private static Signature GetSignatureWithEncodingRetry(string path, ExternalScriptInfo script)
{
string verificationContents = System.Text.Encoding.Unicode.GetString(script.OriginalEncoding.GetPreamble()) + script.ScriptContents;
Signature signature = SignatureHelper.GetSignature(path, verificationContents);
// Invoke the SIP directly with the most simple method
Copy link
Contributor

@PaulHigin PaulHigin Feb 22, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This comment is confusing to me, what is the simple method? I think it should say something like 'first try to get a catalog signature, by passing in null content'.

Copy link
Collaborator Author

@JamesWTruher JamesWTruher Feb 22, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My understanding is that the missing catalog look up is only part of the problem, and that we should be letting the SIP try to validate with out our "help". @TravisEz13 can perhaps address additional points.

Copy link
Member

@TravisEz13 TravisEz13 Feb 22, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think getting the catalog is only half of it, like James is saying. If we fail to get a catalog signature, we try to get the embedded signature without modifying the content. This should be what we try first. It is the only thing we do in Get-AuthenticodeSignature.

Signature signature = SignatureHelper.GetSignature(path, fileContent: null);
if (signature.Status == SignatureStatus.Valid)
{
return signature;
}

// try harder to validate the signature by being explicit about encoding
// and providing the script contents
string verificationContents = Encoding.Unicode.GetString(script.OriginalEncoding.GetPreamble()) + script.ScriptContents;
signature = SignatureHelper.GetSignature(path, verificationContents);

// A last ditch effort -
// If the file was originally ASCII or UTF8, the SIP may have added the Unicode BOM
if ((signature.Status != SignatureStatus.Valid) && (script.OriginalEncoding != System.Text.Encoding.Unicode))
if (signature.Status != SignatureStatus.Valid
&& script.OriginalEncoding != Encoding.Unicode)
{
verificationContents = System.Text.Encoding.Unicode.GetString(System.Text.Encoding.Unicode.GetPreamble()) + script.ScriptContents;
verificationContents = Encoding.Unicode.GetString(Encoding.Unicode.GetPreamble()) + script.ScriptContents;
Signature fallbackSignature = SignatureHelper.GetSignature(path, verificationContents);

if (fallbackSignature.Status == SignatureStatus.Valid)
Expand Down