mirror of
https://blitiri.com.ar/repos/chasquid
synced 2026-10-29 15:02:30 +00:00
Alberto Bertogli
b3b1f39d85
Today, we fold header names with strings.EqualFold when signing, but strings.ToLower when verifying. This should be harmless for valid messages (that have only ASCII characters in the header names), but if one contains an (invalid) header with a non-ASCII character, we could fail to verify the message we sign. The inconsistency would only happen if a header has a non-ASCII character that strings.EqualFold and strings.ToLower handle differently (like "ſubject", with U+017F). To make signing and verifying consistent, this patch makes signing use strings.ToLower. This bug was found by fuzzing the sign-verify cycle, which will be added in a later patch.