From 966817a060cbda6fe2fdc802c26eb197425e6ae4 Mon Sep 17 00:00:00 2001 From: Tristan Partin Date: Mon, 17 Aug 2026 15:46:40 +0000 Subject: [PATCH v1] Improve SSH key parsing We previously rejected SSH keys with comments that included spaces. Nothing in the SSH key specification forbids that. Signed-off-by: Tristan Partin --- pgweb/core/models.py | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/pgweb/core/models.py b/pgweb/core/models.py index 63eb8275..0da661da 100644 --- a/pgweb/core/models.py +++ b/pgweb/core/models.py @@ -258,18 +258,22 @@ def date(self): # Options, keytype, key, comment. But we don't support options. -def validate_sshkey(key): +def validate_sshkey(key: str): lines = key.splitlines() for k in lines: - pieces = k.split() + pieces = k.split(maxsplit=2) if len(pieces) == 0: raise ValidationError("Empty keys are not allowed") - if len(pieces) > 3: + if len(pieces) < 2: raise ValidationError('Paste each ssh key without options, e.g. "ssh-rsa AAAAbbbcc mykey@machine"') if pieces[0] == 'ssh-dss': raise ValidationError("For security reasons, ssh-dss keys are not supported") if pieces[0] not in _valid_keytypes: - raise ValidationError("Only keys of types {0} are supported, not {1}.".format(", ".join(_valid_keytypes), pieces[0])) + raise ValidationError( + 'Only keys of types {0} are supported, not "{1}". ' + 'If you pasted a key with options (e.g. from an authorized_keys file), ' + 'remove the options field before the key type.'.format(", ".join(_valid_keytypes), pieces[0]) + ) try: base64.b64decode(pieces[1]) except Exception as e: -- Tristan Partin https://tristan.partin.io