Add a failable initializer for parsing untrusted OID strings - #121
Open
Nadav0077 wants to merge 5 commits into
Open
Add a failable initializer for parsing untrusted OID strings#121Nadav0077 wants to merge 5 commits into
Nadav0077 wants to merge 5 commits into
Conversation
Motivation: `ASN1ObjectIdentifier.init(dotRepresentation:)` is documented as a parser for already-validated input and terminates the process when the components do not satisfy the ASN.1 OID rules from ITU-T X.690 §8.19.4 or when the encoding step `(firstComponent * 40) + secondComponent` overflows `UInt`. Callers that need to accept OID strings from untrusted sources currently have no built-in way to reject malformed input without risking a process abort. Modifications: * Add `ASN1ObjectIdentifier.init?(validating: String)` alongside the existing throwing variant. The new initializer performs the same syntactic parse and additionally validates the first arc (must be 0, 1, or 2) and the second arc (must be less than 40 when the first is 0 or 1), and uses `addingReportingOverflow` for the residual case where the first arc is 2 and the second arc is close to `UInt.max`. Any failure returns `nil`. * Existing throwing initializers and array-literal conformance are left unchanged. * Add a new test, `testOIDFailableStringInitializer`, covering the happy path and every rejection case (malformed input, out-of-range first/second arcs, both overflow paths). Result: Callers can now parse OID strings from untrusted sources by writing `ASN1ObjectIdentifier(validating: input)` and treating a `nil` result as a parse failure, with no risk of terminating the process.
Lukasa
reviewed
Jun 22, 2026
Author
Lukasa
reviewed
Jun 23, 2026
Lukasa
left a comment
Lukasa
left a comment
Contributor
There was a problem hiding this comment.
I'm still not seeing anything in the diff actually replacing the body of the other initializer
Author
|
@Lukasa Sorry, this should be fixed now. I also cleaned up the docs/PR description so they match the new delegation path. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation:
ASN1ObjectIdentifier.init(dotRepresentation:)is documented as a parser for already-validated input and used to terminate the process when the components did not satisfy the ASN.1 OID rules from ITU-T X.690 8.19.4 or when the encoding step(firstComponent * 40) + secondComponentoverflowedUInt. Callers that need to accept OID strings from untrusted sources currently have no built-in way to reject malformed input without risking a process abort.Modifications:
ASN1ObjectIdentifier.init?(validating: String)alongside the existing throwing variant. The new initializer validates the string syntax, validates the first arc (must be 0, 1, or 2) and the second arc (must be less than 40 when the first is 0 or 1), and usesaddingReportingOverflowfor the residual case where the first arc is 2 and the second arc is close toUInt.max. Any failure returnsnil.testOIDFailableStringInitializer, covering the happy path and every rejection case (malformed input, out-of-range first/second arcs, both overflow paths).Result:
Callers can now parse OID strings from untrusted sources by writing
ASN1ObjectIdentifier(validating: input)and treating anilresult as a parse failure, with no risk of terminating the process.