c2pa-rs

commit 7c1b0c355ee465bc4d01337a62e3e463d5333dad
parent bc93a10100c6fcfd88c16a1d55d2b052ed78cf50
Author: mauricefisher64 <92736594+mauricefisher64@users.noreply.github.com>
Date:   Thu, 27 Oct 2022 17:00:31 -0400

Fix for XMP links being mistaken for remote URLs (#147)

* Fix for XMP links being mistaken for remote URLs
Add change to cose_validator so that certs without organization is not an error

* PR comments

* PR  changes
Diffstat:
M
sdk/src/cose_validator.rs
 | 
6
+++---
M
sdk/src/store.rs
 | 
13
++++++++++++-

2 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/sdk/src/cose_validator.rs b/sdk/src/cose_validator.rs
@@ -887,7 +887,7 @@ fn validate_with_cert(
     let pk_der = pk.raw;
 
     if validator.validate(sig, data, pk_der)? {
-        Ok(extract_subject_from_cert(&signcert)?)
+        Ok(extract_subject_from_cert(&signcert).unwrap_or_default())
     } else {
         Err(Error::CoseSignature)
     }
@@ -906,7 +906,7 @@ async fn validate_with_cert_async(
     let pk_der = pk.raw;
 
     if validate_async(signing_alg, sig, data, pk_der).await? {
-        Ok(extract_subject_from_cert(&signcert)?)
+        Ok(extract_subject_from_cert(&signcert).unwrap_or_default())
     } else {
         Err(Error::CoseSignature)
     }
@@ -928,7 +928,7 @@ async fn validate_with_cert_async(
     let validator = get_validator(signing_alg);
 
     if validator.validate(sig, data, pk_der)? {
-        Ok(extract_subject_from_cert(&signcert)?)
+        Ok(extract_subject_from_cert(&signcert).unwrap_or_default())
     } else {
         Err(Error::CoseSignature)
     }
diff --git a/sdk/src/store.rs b/sdk/src/store.rs
@@ -1888,7 +1888,10 @@ impl Store {
                     )
                     .provenance
                     {
-                        if cfg!(feature = "fetch_remote_manifests") {
+                        // verify provenance path is remote url
+                        let is_remote_url = Store::is_valid_remote_url(&ext_ref);
+
+                        if cfg!(feature = "fetch_remote_manifests") && is_remote_url {
                             Store::fetch_remote_manifest(&ext_ref)
                         } else {
                             // return an error with the url that should be read
@@ -1981,6 +1984,14 @@ impl Store {
         }
     }
 
+    /// check the input url to see if it is a supported remotes URI
+    pub fn is_valid_remote_url(url: &str) -> bool {
+        match url::Url::parse(url) {
+            Ok(u) => u.scheme() == "http" || u.scheme() == "https",
+            Err(_) => false,
+        }
+    }
+
     /// Load Store from a in-memory asset
     /// asset_type: asset extension or mime type
     /// data: reference to bytes of the the file