From f1f738c708ed58e11b94bfc08736a341216e0cef Mon Sep 17 00:00:00 2001 From: Songstats Audit Date: Sat, 29 Aug 2026 22:28:30 +0200 Subject: [PATCH 1/2] Load URI before normalizing malformed keys --- lib/cose/key.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/cose/key.rb b/lib/cose/key.rb index 6a0da3f..eac1c5e 100644 --- a/lib/cose/key.rb +++ b/lib/cose/key.rb @@ -6,6 +6,7 @@ require "cose/key/rsa" require "cose/key/symmetric" require "openssl" +require "uri" module COSE class Error < StandardError; end From 287f739a030760cf9675db0c8c2ab557d18aba89 Mon Sep 17 00:00:00 2001 From: Songstats Audit Date: Sat, 29 Aug 2026 22:28:53 +0200 Subject: [PATCH 2/2] Normalize deeply nested malformed key errors --- lib/cose/key.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/cose/key.rb b/lib/cose/key.rb index eac1c5e..413caf5 100644 --- a/lib/cose/key.rb +++ b/lib/cose/key.rb @@ -53,7 +53,8 @@ def self.deserialize(data) def self.cbor_decode(data) CBOR.decode(data) - rescue CBOR::MalformedFormatError, EOFError, FloatDomainError, RegexpError, TypeError, URI::InvalidURIError + rescue CBOR::MalformedFormatError, CBOR::StackError, EOFError, FloatDomainError, RegexpError, TypeError, + URI::InvalidURIError raise COSE::MalformedKeyError, "Malformed CBOR key input" end end