From 310955513724d95ed700bc2312c022822ea94e86 Mon Sep 17 00:00:00 2001
From: Sean Colyer <sean@colyer.name>
Date: Mon, 7 May 2012 21:39:43 -0400
Subject: [PATCH] Added some verification to keyring to check valid email
 address is being queried. Added a regex to util.js that we can use
 throughout.

---
 resources/openpgp.js     | 10 ++++++++--
 resources/openpgp.min.js | 18 +++++++++---------
 src/openpgp.keyring.js   |  8 ++++++--
 src/util/util.js         |  2 ++
 4 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/resources/openpgp.js b/resources/openpgp.js
index 005ca9ea..617940bf 100644
--- a/resources/openpgp.js
+++ b/resources/openpgp.js
@@ -13638,8 +13638,10 @@ function openpgp_keyring() {
 		} else {
 			email = email_address.trim();
 		}
+		if(!util.emailRegEx.test(email)){
+		    return results;
+		}
 		for (var i =0; i < this.publicKeys.length; i++) {
-			
 			for (var j = 0; j < this.publicKeys[i].obj.userIds.length; j++) {
 				if (this.publicKeys[i].obj.userIds[j].text.indexOf(email) >= 0)
 					results[results.length] = this.publicKeys[i];
@@ -13663,8 +13665,10 @@ function openpgp_keyring() {
 		} else {
 			email = email_address.trim();
 		}
+		if(!util.emailRegEx.test(email)){
+		    return results;
+		}
 		for (var i =0; i < this.privateKeys.length; i++) {
-			
 			for (var j = 0; j < this.privateKeys[i].obj.userIds.length; j++) {
 				if (this.privateKeys[i].obj.userIds[j].text.indexOf(email) >= 0)
 					results[results.length] = this.privateKeys[i];
@@ -13806,6 +13810,8 @@ function openpgp_keyring() {
 // Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 
 var Util = function() {
+
+    this.emailRegEx = /[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?/;
 	
 	this.hexdump = function(str) {
 	    var r=[];
diff --git a/resources/openpgp.min.js b/resources/openpgp.min.js
index 3310e91d..0b509168 100644
--- a/resources/openpgp.min.js
+++ b/resources/openpgp.min.js
@@ -480,15 +480,15 @@ function openpgp_type_s2k(){this.read=function(a,b){var c=b;this.type=a[c++].cha
 this.type)}return this};this.write=function(a,b,c,d,e){this.type=a;if(3==this.type)this.saltValue=d,this.hashAlgorithm=b,this.count=16+(e&15)<<(e>>4)+6,this.s2kLength=10;return this.produce_key(c)};this.produce_key=function(a,b){if(0==this.type)return openpgp_crypto_hashData(this.hashAlgorithm,a);if(1==this.type)return openpgp_crypto_hashData(this.hashAlgorithm,this.saltValue+a);if(3==this.type){var c=[];for(c[0]=this.saltValue+a;c.length*(this.saltValue+a).length<this.count;)c.push(this.saltValue+
 a);c=c.join("");c.length>this.count&&(c=c.substr(0,this.count));return b&&(24==b||32==b)?openpgp_crypto_hashData(this.hashAlgorithm,c)+openpgp_crypto_hashData(this.hashAlgorithm,String.fromCharCode(0)+c):openpgp_crypto_hashData(this.hashAlgorithm,c)}return null}}
 function openpgp_keyring(){this.init=function(){var a=JSON.parse(window.localStorage.getItem("privatekeys")),b=JSON.parse(window.localStorage.getItem("publickeys"));if(null==a||0==a.length)a=[];if(null==b||0==b.length)b=[];this.publicKeys=[];this.privateKeys=[];for(var c=0,d=0;d<a.length;d++){var e=openpgp.read_privateKey(a[d]);this.privateKeys[c]={armored:a[d],obj:e[0],keyId:e[0].getKeyId()};c++}for(d=c=0;d<b.length;d++)e=openpgp.read_publicKey(b[d]),null!=e[0]&&(this.publicKeys[c]={armored:b[d],
-obj:e[0],keyId:e[0].getKeyId()},c++)};this.hasPrivateKey=function(){return 0<this.privateKeys.length};this.store=function(){for(var a=[],b=0;b<this.privateKeys.length;b++)a[b]=this.privateKeys[b].armored;for(var c=[],b=0;b<this.publicKeys.length;b++)c[b]=this.publicKeys[b].armored;window.localStorage.setItem("privatekeys",JSON.stringify(a));window.localStorage.setItem("publickeys",JSON.stringify(c))};this.getPublicKeyForAddress=function(a){for(var b=[],c=a.split("<"),d="",d=1<c.length?c[1].split(">")[0]:
-a.trim(),a=0;a<this.publicKeys.length;a++)for(c=0;c<this.publicKeys[a].obj.userIds.length;c++)0<=this.publicKeys[a].obj.userIds[c].text.indexOf(d)&&(b[b.length]=this.publicKeys[a]);return b};this.getPrivateKeyForAddress=function(a){for(var b=[],c=a.split("<"),d="",d=1<c.length?c[1].split(">")[0]:a.trim(),a=0;a<this.privateKeys.length;a++)for(c=0;c<this.privateKeys[a].obj.userIds.length;c++)0<=this.privateKeys[a].obj.userIds[c].text.indexOf(d)&&(b[b.length]=this.privateKeys[a]);return b};this.getPublicKeysForKeyId=
-function(a){for(var b=[],c=0;c<this.publicKeys.length;c++)a==this.publicKeys[c].obj.getKeyId()&&(b[b.length]=this.publicKeys[c]);return b};this.getPrivateKeyForKeyId=function(a){for(var b=[],c=0;c<this.privateKeys.length;c++)if(a==this.privateKeys[c].obj.getKeyId()&&(b[b.length]={key:this.privateKeys[c],keymaterial:this.privateKeys[c].obj.privateKeyPacket}),null!=this.privateKeys[c].obj.subKeys)for(var d=this.privateKeys[c].obj.getSubKeyIds(),e=0;e<d.length;e++)a==util.hexstrdump(d[e])&&(b[b.length]=
-{key:this.privateKeys[c],keymaterial:this.privateKeys[c].obj.subKeys[e]});return b};this.importPublicKey=function(a){for(var b=openpgp.read_publicKey(a),c=0;c<b.length;c++)this.publicKeys[this.publicKeys.length]={armored:a,obj:b[c],keyId:b[c].getKeyId()};return!0};this.importPrivateKey=function(a,b){var c=openpgp.read_privateKey(a);if(!c[0].decryptSecretMPIs(b))return!1;for(var d=0;d<c.length;d++)this.privateKeys[this.privateKeys.length]={armored:a,obj:c[d],keyId:c[d].getKeyId()};return!0};this.exportPublicKey=
-function(a){return this.publicKey[a]};this.removePublicKey=function(a){a=this.publicKeys.splice(a,1);this.store();return a};this.exportPrivateKey=function(a){return this.privateKeys[a]};this.removePrivateKey=function(a){a=this.privateKeys.splice(a,1);this.store();return a}}
-var Util=function(){this.hexdump=function(a){for(var b=[],c=a.length,d=0,e,f=0;d<c;){for(e=a.charCodeAt(d++).toString(16);2>e.length;)e="0"+e;b.push(" "+e);f++;0==f%32&&b.push("\n           ")}return b.join("")};this.hexstrdump=function(a){if(null==a)return"";for(var b=[],c=a.length,d=0,e;d<c;){for(e=a[d++].charCodeAt().toString(16);2>e.length;)e="0"+e;b.push(""+e)}return b.join("")};this.hex2bin=function(a){for(var b="",c=0;c<a.length;c+=2)b+=String.fromCharCode(parseInt(a.substr(c,2),16));return b};
-this.hexidump=function(a){for(var b=[],c=a.length,d=0,e;d<c;){for(e=a[d++].toString(16);2>e.length;)e="0"+e;b.push(""+e)}return b.join("")};this.str2bin=function(a){for(var b=[],c=0;c<a.length;c++)b[c]=a.charCodeAt(c);return b};this.bin2str=function(a){for(var b=[],c=0;c<a.length;c++)b.push(String.fromCharCode(a[c]));return b.join("")};this.str2Uint8Array=function(a){for(var b=new Uint8Array(new ArrayBuffer(a.length)),c=0;c<a.length;c++)b[c]=a.charCodeAt(c);return b};this.Uint8Array2str=function(a){var b=
-[];for(n=0;n<a.length;n++)b[n]=String.fromCharCode(a[n]);return b.join("")};this.calc_checksum=function(a){for(var b={s:0,add:function(a){this.s=(this.s+a)%65536}},c=0;c<a.length;c++)b.add(a.charCodeAt(c));return b.s};this.print_debug=function(a){openpgp.config.debug&&(a=openpgp_encoding_html_encode(a),showMessages('<tt><p style="background-color: #ffffff; width: 652px; word-break: break-word; padding: 5px; border-bottom: 1px solid black;">'+a.replace(/\n/g,"<br>")+"</p></tt>"))};this.print_debug_hexstr_dump=
-function(a,b){openpgp.config.debug&&(a+=this.hexstrdump(b),a=openpgp_encoding_html_encode(a),showMessages('<tt><p style="background-color: #ffffff; width: 652px; word-break: break-word; padding: 5px; border-bottom: 1px solid black;">'+a.replace(/\n/g,"<br>")+"</p></tt>"))};this.print_error=function(a){a=openpgp_encoding_html_encode(a);showMessages('<p style="font-size: 80%; background-color: #FF8888; margin:0; width: 652px; word-break: break-word; padding: 5px; border-bottom: 1px solid black;"><span style="color: #888;"><b>ERROR:</b></span>\t'+
+obj:e[0],keyId:e[0].getKeyId()},c++)};this.hasPrivateKey=function(){return 0<this.privateKeys.length};this.store=function(){for(var a=[],b=0;b<this.privateKeys.length;b++)a[b]=this.privateKeys[b].armored;for(var c=[],b=0;b<this.publicKeys.length;b++)c[b]=this.publicKeys[b].armored;window.localStorage.setItem("privatekeys",JSON.stringify(a));window.localStorage.setItem("publickeys",JSON.stringify(c))};this.getPublicKeyForAddress=function(a){var b=[],c=a.split("<"),d="",d=1<c.length?c[1].split(">")[0]:
+a.trim();if(!util.emailRegEx.test(d))return b;for(a=0;a<this.publicKeys.length;a++)for(c=0;c<this.publicKeys[a].obj.userIds.length;c++)0<=this.publicKeys[a].obj.userIds[c].text.indexOf(d)&&(b[b.length]=this.publicKeys[a]);return b};this.getPrivateKeyForAddress=function(a){var b=[],c=a.split("<"),d="",d=1<c.length?c[1].split(">")[0]:a.trim();if(!util.emailRegEx.test(d))return b;for(a=0;a<this.privateKeys.length;a++)for(c=0;c<this.privateKeys[a].obj.userIds.length;c++)0<=this.privateKeys[a].obj.userIds[c].text.indexOf(d)&&
+(b[b.length]=this.privateKeys[a]);return b};this.getPublicKeysForKeyId=function(a){for(var b=[],c=0;c<this.publicKeys.length;c++)a==this.publicKeys[c].obj.getKeyId()&&(b[b.length]=this.publicKeys[c]);return b};this.getPrivateKeyForKeyId=function(a){for(var b=[],c=0;c<this.privateKeys.length;c++)if(a==this.privateKeys[c].obj.getKeyId()&&(b[b.length]={key:this.privateKeys[c],keymaterial:this.privateKeys[c].obj.privateKeyPacket}),null!=this.privateKeys[c].obj.subKeys)for(var d=this.privateKeys[c].obj.getSubKeyIds(),
+e=0;e<d.length;e++)a==util.hexstrdump(d[e])&&(b[b.length]={key:this.privateKeys[c],keymaterial:this.privateKeys[c].obj.subKeys[e]});return b};this.importPublicKey=function(a){for(var b=openpgp.read_publicKey(a),c=0;c<b.length;c++)this.publicKeys[this.publicKeys.length]={armored:a,obj:b[c],keyId:b[c].getKeyId()};return!0};this.importPrivateKey=function(a,b){var c=openpgp.read_privateKey(a);if(!c[0].decryptSecretMPIs(b))return!1;for(var d=0;d<c.length;d++)this.privateKeys[this.privateKeys.length]={armored:a,
+obj:c[d],keyId:c[d].getKeyId()};return!0};this.exportPublicKey=function(a){return this.publicKey[a]};this.removePublicKey=function(a){a=this.publicKeys.splice(a,1);this.store();return a};this.exportPrivateKey=function(a){return this.privateKeys[a]};this.removePrivateKey=function(a){a=this.privateKeys.splice(a,1);this.store();return a}}
+var Util=function(){this.emailRegEx=/[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?/;this.hexdump=function(a){for(var b=[],c=a.length,d=0,e,f=0;d<c;){for(e=a.charCodeAt(d++).toString(16);2>e.length;)e="0"+e;b.push(" "+e);f++;0==f%32&&b.push("\n           ")}return b.join("")};this.hexstrdump=function(a){if(null==a)return"";for(var b=[],c=a.length,d=0,e;d<c;){for(e=a[d++].charCodeAt().toString(16);2>e.length;)e=
+"0"+e;b.push(""+e)}return b.join("")};this.hex2bin=function(a){for(var b="",c=0;c<a.length;c+=2)b+=String.fromCharCode(parseInt(a.substr(c,2),16));return b};this.hexidump=function(a){for(var b=[],c=a.length,d=0,e;d<c;){for(e=a[d++].toString(16);2>e.length;)e="0"+e;b.push(""+e)}return b.join("")};this.str2bin=function(a){for(var b=[],c=0;c<a.length;c++)b[c]=a.charCodeAt(c);return b};this.bin2str=function(a){for(var b=[],c=0;c<a.length;c++)b.push(String.fromCharCode(a[c]));return b.join("")};this.str2Uint8Array=
+function(a){for(var b=new Uint8Array(new ArrayBuffer(a.length)),c=0;c<a.length;c++)b[c]=a.charCodeAt(c);return b};this.Uint8Array2str=function(a){var b=[];for(n=0;n<a.length;n++)b[n]=String.fromCharCode(a[n]);return b.join("")};this.calc_checksum=function(a){for(var b={s:0,add:function(a){this.s=(this.s+a)%65536}},c=0;c<a.length;c++)b.add(a.charCodeAt(c));return b.s};this.print_debug=function(a){openpgp.config.debug&&(a=openpgp_encoding_html_encode(a),showMessages('<tt><p style="background-color: #ffffff; width: 652px; word-break: break-word; padding: 5px; border-bottom: 1px solid black;">'+
+a.replace(/\n/g,"<br>")+"</p></tt>"))};this.print_debug_hexstr_dump=function(a,b){openpgp.config.debug&&(a+=this.hexstrdump(b),a=openpgp_encoding_html_encode(a),showMessages('<tt><p style="background-color: #ffffff; width: 652px; word-break: break-word; padding: 5px; border-bottom: 1px solid black;">'+a.replace(/\n/g,"<br>")+"</p></tt>"))};this.print_error=function(a){a=openpgp_encoding_html_encode(a);showMessages('<p style="font-size: 80%; background-color: #FF8888; margin:0; width: 652px; word-break: break-word; padding: 5px; border-bottom: 1px solid black;"><span style="color: #888;"><b>ERROR:</b></span>\t'+
 a.replace(/\n/g,"<br>")+"</p>")};this.print_info=function(a){a=openpgp_encoding_html_encode(a);showMessages('<p style="font-size: 80%; background-color: #88FF88; margin:0; width: 652px; word-break: break-word; padding: 5px; border-bottom: 1px solid black;"><span style="color: #888;"><b>INFO:</b></span>\t'+a.replace(/\n/g,"<br>")+"</p>")};this.print_warning=function(a){a=openpgp_encoding_html_encode(a);showMessages('<p style="font-size: 80%; background-color: #FFAA88; margin:0; width: 652px; word-break: break-word; padding: 5px; border-bottom: 1px solid black;"><span style="color: #888;"><b>WARNING:</b></span>\t'+
 a.replace(/\n/g,"<br>")+"</p>")};this.getLeftNBits=function(a,b){var c=b%8;return 0==c?a.substring(0,b/8):this.shiftRight(a.substring(0,(b-c)/8+1),8-c)};this.shiftRight=function(a,b){var c=util.str2bin(a);if(0!=b%8)for(var d=c.length-1;0<=d;d--)c[d]>>=b%8,0<d&&(c[d]|=c[d-1]<<8-b%8&255);else return a;return util.bin2str(c)};this.get_hashAlgorithmString=function(a){switch(a){case 1:return"MD5";case 2:return"SHA1";case 3:return"RIPEMD160";case 8:return"SHA256";case 9:return"SHA384";case 10:return"SHA512";
 case 11:return"SHA224"}return"unknown"}},util=new Util;
diff --git a/src/openpgp.keyring.js b/src/openpgp.keyring.js
index 3fb8ef60..a2b5d3f7 100644
--- a/src/openpgp.keyring.js
+++ b/src/openpgp.keyring.js
@@ -93,8 +93,10 @@ function openpgp_keyring() {
 		} else {
 			email = email_address.trim();
 		}
+		if(!util.emailRegEx.test(email)){
+		    return results;
+		}
 		for (var i =0; i < this.publicKeys.length; i++) {
-			
 			for (var j = 0; j < this.publicKeys[i].obj.userIds.length; j++) {
 				if (this.publicKeys[i].obj.userIds[j].text.indexOf(email) >= 0)
 					results[results.length] = this.publicKeys[i];
@@ -118,8 +120,10 @@ function openpgp_keyring() {
 		} else {
 			email = email_address.trim();
 		}
+		if(!util.emailRegEx.test(email)){
+		    return results;
+		}
 		for (var i =0; i < this.privateKeys.length; i++) {
-			
 			for (var j = 0; j < this.privateKeys[i].obj.userIds.length; j++) {
 				if (this.privateKeys[i].obj.userIds[j].text.indexOf(email) >= 0)
 					results[results.length] = this.privateKeys[i];
diff --git a/src/util/util.js b/src/util/util.js
index 02cd7b69..e62475a6 100644
--- a/src/util/util.js
+++ b/src/util/util.js
@@ -16,6 +16,8 @@
 // Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 
 var Util = function() {
+
+    this.emailRegEx = /[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?/;
 	
 	this.hexdump = function(str) {
 	    var r=[];