Skip to content

fix: Add checks for valid trust keys and fetched resource response size#109

Merged
ale-adobe merged 4 commits into
mainfrom
ale/VULN-33395
May 14, 2026
Merged

fix: Add checks for valid trust keys and fetched resource response size#109
ale-adobe merged 4 commits into
mainfrom
ale/VULN-33395

Conversation

@ale-adobe
Copy link
Copy Markdown
Contributor

@ale-adobe ale-adobe commented May 14, 2026

This PR adds the following guards and checks to the resolveTrustSettings API:

  • Only process keys in the TrustSettings interface when resolving the passed-in trust settings (other keys could exist, such as those in an extending interface like CawgTrustSettings), which are known to be the ones that we want to actually process.
  • Cap responses from fetching resources from trust URLs to 1MB, which should be a generous upper bound on what a realistic trust anchor or config file could reach. Anything over that size will throw an error.

@ale-adobe ale-adobe requested a review from emensch May 14, 2026 22:19
@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented May 14, 2026

🦋 Changeset detected

Latest commit: 330517a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@contentauth/c2pa-web Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Comment thread packages/c2pa-web/src/lib/settings.ts Outdated
@ale-adobe ale-adobe changed the title fix: Add checks for valid trust keys, response size, and URL fetch limits fix: Add checks for valid trust keys and fetched resource response size May 14, 2026
@ale-adobe ale-adobe merged commit d4ee9cd into main May 14, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants