check the input before sign/verify (#228)

Author: cyjseagull

sdk-crypto/src/main/java/org/fisco/bcos/sdk/crypto/signature/ECDSASignature.java

@@ -21,6 +21,8 @@
 import org.fisco.bcos.sdk.utils.Numeric;
 
 public class ECDSASignature implements Signature {
+    private static int INPUT_MESSAGE_SIZE_IN_HEX = 64;
+
     @Override
     public SignatureResult sign(final String message, final CryptoKeyPair keyPair) {
         // convert signature string to SignatureResult struct
@@ -32,11 +34,19 @@ public SignatureResult sign(final byte[] message, final CryptoKeyPair keyPair) {
         return sign(Hex.toHexString(message), keyPair);
     }
 
+    private void checkInputMessage(final String message) {
+        if (message.length() != INPUT_MESSAGE_SIZE_IN_HEX) {
+            throw new SignatureException(
+                    "Invalid input message " + message + ", must be a hex string of length 64");
+        }
+    }
+
     @Override
     public String signWithStringSignature(final String message, final CryptoKeyPair keyPair) {
+        String inputMessage = Numeric.cleanHexPrefix(message);
+        checkInputMessage(inputMessage);
         CryptoResult signatureResult =
-                NativeInterface.secp256k1Sign(
-                        keyPair.getHexPrivateKey(), Numeric.cleanHexPrefix(message));
+                NativeInterface.secp256k1Sign(keyPair.getHexPrivateKey(), inputMessage);
         // call secp256k1Sign failed
         if (signatureResult.wedprErrorMessage != null
                 && !signatureResult.wedprErrorMessage.isEmpty()) {
@@ -49,14 +59,15 @@ public String signWithStringSignature(final String message, final CryptoKeyPair
 
     @Override
     public boolean verify(final String publicKey, final String message, final String signature) {
+        String inputMessage = Numeric.cleanHexPrefix(message);
+        checkInputMessage(inputMessage);
         String hexPubKeyWithPrefix =
                 Numeric.getHexKeyWithPrefix(
                         publicKey,
                         CryptoKeyPair.UNCOMPRESSED_PUBLICKEY_FLAG_STR,
                         CryptoKeyPair.PUBLIC_KEY_LENGTH_IN_HEX);
         CryptoResult verifyResult =
-                NativeInterface.secp256k1verify(
-                        hexPubKeyWithPrefix, Numeric.cleanHexPrefix(message), signature);
+                NativeInterface.secp256k1verify(hexPubKeyWithPrefix, inputMessage, signature);
         // call secp256k1verify failed
         if (verifyResult.wedprErrorMessage != null && !verifyResult.wedprErrorMessage.isEmpty()) {
             throw new SignatureException(

sdk-crypto/src/test/java/org/fisco/bcos/sdk/crypto/SignatureTest.java

@@ -21,6 +21,7 @@
 import org.fisco.bcos.sdk.config.ConfigOption;
 import org.fisco.bcos.sdk.config.exceptions.ConfigException;
 import org.fisco.bcos.sdk.crypto.exceptions.KeyPairException;
+import org.fisco.bcos.sdk.crypto.exceptions.SignatureException;
 import org.fisco.bcos.sdk.crypto.hash.Hash;
 import org.fisco.bcos.sdk.crypto.hash.Keccak256;
 import org.fisco.bcos.sdk.crypto.hash.SM3Hash;
@@ -321,6 +322,27 @@ public void testSignature(Hash hasher, Signature signature, CryptoKeyPair keyPai
                             invalidMessage,
                             signResult.convertToString()));
         }
+
+        // invalid input
+        try {
+            String invalidMessage = "0xb3b9ce5a0725c1457b8c7872d05accb3887ecc09a50dc7619b53837e4d9f";
+            SignatureResult signResult = signature.sign(invalidMessage, keyPair);
+        }catch(SignatureException e)
+        {
+            System.out.println("Sign failed for " + e.getMessage());
+        }
+
+        try {
+            String invalidMessage = "";
+            for(int i = 0; i < 64; i++)
+            {
+                invalidMessage += "r";
+            }
+            SignatureResult signResult = signature.sign(invalidMessage, keyPair);
+        }catch(SignatureException e)
+        {
+            System.out.println("Sign failed for " + e.getMessage());
+        }
     }
 
     public void testSignature(CryptoSuite signature, CryptoKeyPair keyPair) {