Disallow Selecting .pub files for SSH & SSL Keys about sequel-ace HOT 8 CLOSED

We can just look in the file, and if we see PRIVATE KEY----- twice, it should be good.

Most ppl use RSA keys, which contain -----BEGIN RSA PRIVATE KEY----- and the equivalent end tag, but I myself use an ED25519 key, which contains -----BEGIN OPENSSH PRIVATE KEY-----. Looking for just the common suffix should be good enough.

from sequel-ace.

I've updated my branch with some better validation: https://github.com/jamesstout/Sequel-Ace/tree/more-permissions

from sequel-ace.

Should be a simple change to this validation:

EDIT: No, not as simple as that, SP of course has it's own data/line parsing code....

from sequel-ace.

Most ppl use RSA keys, which contain -----BEGIN RSA PRIVATE KEY----- and the equivalent end tag, but I myself use an ED25519 key, which contains -----BEGIN OPENSSH PRIVATE KEY-----. Looking for just the common suffix should be good enough.

What does your cert file have as first/last lines?

from sequel-ace.

-----BEGIN OPENSSH PRIVATE KEY-----
...
-----END OPENSSH PRIVATE KEY-----

from sequel-ace.

I've updated my branch with some better validation: https://github.com/jamesstout/Sequel-Ace/tree/more-permissions

Looks good to me!
With SecurityScopedBookmarks, do we have to somehow start accessing the specific bookmark when we begin a connection and end it out when we close the connection? How does that work with quitting and reopening the app?

from sequel-ace.

With SecurityScopedBookmarks, do we have to somehow start accessing the specific bookmark when we begin a connection and end it out when we close the connection? How does that work with quitting and reopening the app?

Ah, that's a good point, I've forgotten to relinquish access with stopAccessingSecurityScopedResource. In the export controller, I relinquish access when the export ends. We no longer need access.

For the connection controller, we [currently] copy the key to the sandbox, so could call stopAccessingSecurityScopedResource as soon as the key/cert is validated and copied.

However, there was discussion about no longer copying the keys: #52 (comment), so I'd have to figure out where to relinquish access. Maybe after the connection completes. I haven't looked at the actual connection code to see if it retries, or needs the key to keep alive.

I'll have a look later.

from sequel-ace.

I've put stopAccessingSecurityScopedResource in _documentWillClose and dealloc. Please see the branch mentioned above.

from sequel-ace.