From 29063374229d39223618e53078ebc6592157006b Mon Sep 17 00:00:00 2001 From: Oskar Eichler Date: Sun, 30 Aug 2026 01:38:28 +0200 Subject: [PATCH 1/2] Normalize malformed signature verification errors --- lib/openssl/signature_algorithm/base.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/openssl/signature_algorithm/base.rb b/lib/openssl/signature_algorithm/base.rb index c7c9e5a..4f519a8 100644 --- a/lib/openssl/signature_algorithm/base.rb +++ b/lib/openssl/signature_algorithm/base.rb @@ -38,6 +38,8 @@ def verify(signature, verification_data) verify_key.verify(hash_function, formatted_signature, verification_data) || raise(OpenSSL::SignatureAlgorithm::SignatureVerificationError, "Signature verification failed") + rescue OpenSSL::PKey::PKeyError + raise(OpenSSL::SignatureAlgorithm::SignatureVerificationError, "Signature verification failed") end end end From 236ea5ceac42aa7254f5540bbcdbd6fa9303c203 Mon Sep 17 00:00:00 2001 From: Oskar Eichler Date: Thu, 3 Sep 2026 19:17:53 +0700 Subject: [PATCH 2/2] Normalize malformed verification inputs --- lib/openssl/signature_algorithm/base.rb | 10 ++++++++++ lib/openssl/signature_algorithm/eddsa.rb | 3 ++- lib/openssl/signature_algorithm/rsapss.rb | 1 + 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/lib/openssl/signature_algorithm/base.rb b/lib/openssl/signature_algorithm/base.rb index 4f519a8..5a3cd24 100644 --- a/lib/openssl/signature_algorithm/base.rb +++ b/lib/openssl/signature_algorithm/base.rb @@ -29,6 +29,8 @@ def sign(data) end def verify(signature, verification_data) + validate_verification_inputs!(signature, verification_data) + formatted_signature = if respond_to?(:formatted_signature, true) formatted_signature(signature) @@ -41,6 +43,14 @@ def verify(signature, verification_data) rescue OpenSSL::PKey::PKeyError raise(OpenSSL::SignatureAlgorithm::SignatureVerificationError, "Signature verification failed") end + + private + + def validate_verification_inputs!(signature, verification_data) + return if signature.is_a?(String) && verification_data.is_a?(String) + + raise(OpenSSL::SignatureAlgorithm::SignatureVerificationError, "Signature verification failed") + end end end end diff --git a/lib/openssl/signature_algorithm/eddsa.rb b/lib/openssl/signature_algorithm/eddsa.rb index 88a755c..7c6e409 100644 --- a/lib/openssl/signature_algorithm/eddsa.rb +++ b/lib/openssl/signature_algorithm/eddsa.rb @@ -39,8 +39,9 @@ def sign(data) end def verify(signature, verification_data) + validate_verification_inputs!(signature, verification_data) verify_key.verify(signature, verification_data) - rescue ::Ed25519::VerifyError + rescue ::Ed25519::VerifyError, ArgumentError raise(OpenSSL::SignatureAlgorithm::SignatureVerificationError, "Signature verification failed") end end diff --git a/lib/openssl/signature_algorithm/rsapss.rb b/lib/openssl/signature_algorithm/rsapss.rb index c3d2482..5936939 100644 --- a/lib/openssl/signature_algorithm/rsapss.rb +++ b/lib/openssl/signature_algorithm/rsapss.rb @@ -11,6 +11,7 @@ def sign(data) end def verify(signature, verification_data) + validate_verification_inputs!(signature, verification_data) verify_key.verify_pss( hash_function, signature,