.net 如何从C#代码安全地调用Java keytool

fcwjkofz  于 2023-11-20  发布在  .NET
关注(0)|答案(1)|浏览(135)

我想用C#创建一个GUI，用于在后台在cmd.exe上运行keytool，以创建密钥库，包括密钥和证书数据。
输入数据则需要

  • 密钥库路径
  • 密码
  • 密钥别名
  • 密钥密码
  • 有效性
  • 证书信息（cn、ou、o、l、st和c）

不幸的是，人们可以在密码中键入特殊字符，并且在证书信息中允许空格。
总的来说，我担心有人可能会在某个地方输入一些信息，一旦调用这些信息，就会导致灾难性的命令在后台运行（如rm -rf *）。
有没有一种方法可以将包含输入信息的Java属性文件传递给keytool，或者有没有一种方法可以安全地转义作为字符串参数传递给keytool的所有数据？
我找不到任何类型的文件，keytool可以采取，即使在单独的步骤，这将消除这个问题。
下面是不安全的代码（警告：它不安全！）：

  1. using System;
  2. using System.IO;
  3. using System.Diagnostics;
  4. using System.Collections.Generic;
  5. using System.Text.RegularExpressions;
  7. public class AndroidKeystoreCertificateData
  8. {
  9.   public string FirstAndLastName;
  10.   public string OrganizationalUnit;
  11.   public string OrganizationName;
  12.   public string CityOrLocality;
  13.   public string StateOrProvince;
  14.   public string CountryCode;
  15. }
  17. public class AndroidKeystoreData : AndroidKeystoreCertificateData
  18. {
  19.   public string KeystorePath;
  20.   public string Password;
  21.   public string KeyAlias;
  22.   public string KeyPassword;
  23.   public int ValidityInYears;
  24. }
  26. internal class AndroidUtils
  27. {
  29.   private static bool RunCommand(string command, string working_dir, bool show_window = true)
  30.   {
  31.     using (Process proc = new Process
  32.     {
  33.       StartInfo =
  34.       {
  35.         UseShellExecute = false,
  36.         FileName = "cmd.exe",
  37.         Arguments = command,
  38.         CreateNoWindow = !show_window,
  39.         WorkingDirectory = working_dir
  40.       }
  41.     })
  42.     {
  43.       try
  44.       {
  45.         proc.Start();
  46.         proc.WaitForExit();
  47.         return true;
  48.       }
  49.       catch
  50.       {
  51.         return false;
  52.       }
  53.     }
  54.     return false;
  55.   }
  56.   
  57.   private static string FilterString(string st)
  58.   {
  59.     return Regex.Replace(st, @"[^\w\d _]", "").Trim();
  60.   }
  62.   public static string GetKeystoreCertificateInputString(AndroidKeystoreCertificateData data)
  63.   {
  64.     string strCN = FilterString(data.FirstAndLastName);
  65.     string strOU = FilterString(data.OrganizationalUnit);
  66.     string strO = FilterString(data.OrganizationName);
  67.     string strL = FilterString(data.CityOrLocality);
  68.     string cnST = FilterString(data.StateOrProvince);
  69.     string cnC = FilterString(data.CountryCode);
  71.     string cert = "\"";
  72.     if (!string.IsNullOrEmpty(strCN)) cert += "cn=" + strCN + ", ";
  73.     if (!string.IsNullOrEmpty(strOU)) cert += "ou=" + strOU + ", ";
  74.     if (!string.IsNullOrEmpty(strO))  cert += "o=" + strO + ", ";
  75.     if (!string.IsNullOrEmpty(strL))  cert += "l=" + strL + ", ";
  76.     if (!string.IsNullOrEmpty(cnST))  cert += "st=" + cnST + ", ";
  77.     if (!string.IsNullOrEmpty(cnC))   cert += "c=" + cnC + "\"";
  79.     if (cert.Length > 2) return cert;
  81.     return string.Empty;
  82.   }
  83.   
  84.   private static string GetKeytoolPath()
  85.   {
  86.     string javaHome = Environment.GetEnvironmentVariable("JAVA_HOME", EnvironmentVariableTarget.User);
  87.     return Path.Combine(javaHome, "bin\\keytool");
  88.   }
  90.   private static string GetKeystoreGenerationCommand(AndroidKeystoreData d)
  91.   {
  92.     string cert = GetKeystoreCertificateInputString(d);
  93.     string keytool = GetKeytoolPath();
  94.     string days = (d.ValidityInYears * 365).ToString();
  96.     string dname = "-dname \"cn=" + d.KeyAlias + "\"";
  97.     if (!string.IsNullOrEmpty(cert)) dname = "-dname " + cert;
  99.     string cmd = "echo y | " + keytool + " -genkeypair " + dname + 
  100.         " -alias " + d.KeyAlias + " -keypass " + d.KeyPassword +
  101.         " -keystore " + d.KeystorePath + " -storepass " + d.Password + " -validity " + days;
  103.     return cmd;
  104.   }
  105.   
  106.   public static bool RunGenerateKeystore(AndroidKeystoreData d)
  107.   {
  108.     string cmd = GetKeystoreGenerationCommand(d);
  109.     string wdir = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
  111.     return RunCommand(cmd, wdir, false);
  112.   }
  113. }

字符串
示例用法如下：

  1. using System;
  3. class MainClass
  4. {
  5.   static void Main(string[] args)
  6.   {
  7.     AndroidKeystoreData d = new AndroidKeystoreData();
  9.     d.KeystorePath = "keystorepath";
  10.     d.Password = "pass";
  11.     d.KeyAlias = "key0";
  12.     d.KeyPassword = "pass";
  14.     d.ValidityInYears = 25*365;
  16.     d.FirstAndLastName = "self";
  17.     d.OrganizationalUnit = "my ou";
  18.     d.OrganizationName = "my o";
  19.     d.CityOrLocality = "my city";
  20.     d.StateOrProvince = "my state";
  21.     d.CountryCode = "cc";
  23.     AndroidUtils.RunGenerateKeystore(d);
  24.   }
  25. }

型
repository的|zip file的
关于我尝试的事情的其他信息：

现在我有一个非常严格的正则表达式，但我不知道这是否有问题：名字中有非A-Za-z 0 -9字符的人，如果有人想在密码中使用特殊字符等。理想情况下，如果有一种方法可以安全地通过文件传递参数，我会更喜欢。或者，一种在纯C#中生成Android兼容密钥库的方法，而不依赖于Java keytool。
从上面的MSBuild中直接窃取代码，我设法删除了一些东西，并提出了下面的东西，这似乎是正确的，至少有一个类似的足够有用的功能。

  1. using System;
  2. using System.Text;
  3. using System.Text.RegularExpressions;
  5. namespace AndroidSignTool
  6. {
  7.     public class CommandArgumentsBuilder
  8.     {
  9.         private StringBuilder Cmd { get; } = new StringBuilder();
  11.         private readonly Regex DefinitelyNeedQuotes = new Regex(@"^[a-z\\/:0-9\._\-+=]*$", RegexOptions.None);
  13.         private readonly Regex AllowedUnquoted = new Regex(@"[|><\s,;""]+", RegexOptions.IgnoreCase);
  15.         private bool IsQuotingRequired(string parameter)
  16.         {
  17.             bool isQuotingRequired = false;
  19.             if (parameter != null)
  20.             {
  21.                 bool hasAllUnquotedCharacters = AllowedUnquoted.IsMatch(parameter);
  22.                 bool hasSomeQuotedCharacters = DefinitelyNeedQuotes.IsMatch(parameter);
  24.                 isQuotingRequired = !hasAllUnquotedCharacters;
  25.                 isQuotingRequired = isQuotingRequired || hasSomeQuotedCharacters;
  26.             }
  28.             return isQuotingRequired;
  29.         }
  31.         private void AppendTextWithQuoting(string unquotedTextToAppend)
  32.         {
  33.             if (string.IsNullOrEmpty(unquotedTextToAppend))
  34.                 return;
  36.             bool addQuotes = IsQuotingRequired(unquotedTextToAppend);
  38.             if (addQuotes)
  39.             {
  40.                 Cmd.Append('"');
  41.             }
  43.             // Count the number of quotes
  44.             int literalQuotes = 0;
  45.             for (int i = 0; i < unquotedTextToAppend.Length; i++)
  46.             {
  47.                 if (unquotedTextToAppend[i] == '"')
  48.                 {
  49.                     literalQuotes++;
  50.                 }
  51.             }
  52.             if (literalQuotes > 0)
  53.             {
  54.                 // Replace any \" sequences with \\"
  55.                 unquotedTextToAppend = unquotedTextToAppend.Replace("\\\"", "\\\\\"");
  56.                 // Now replace any " with \"
  57.                 unquotedTextToAppend = unquotedTextToAppend.Replace("\"", "\\\"");
  58.             }
  60.             Cmd.Append(unquotedTextToAppend);
  62.             // Be careful any trailing slash doesn't escape the quote we're about to add
  63.             if (addQuotes && unquotedTextToAppend.EndsWith("\\", StringComparison.Ordinal))
  64.             {
  65.                 Cmd.Append('\\');
  66.             }
  68.             if (addQuotes)
  69.             {
  70.                 Cmd.Append('"');
  71.             }
  72.         }
  74.         public CommandArgumentsBuilder()
  75.         {
  76.         }
  78.         public void AppendSwitch(string switchName)
  79.         {
  80.             if (string.IsNullOrEmpty(switchName))
  81.                 return;
  83.             if (Cmd.Length != 0 && Cmd[Cmd.Length - 1] != ' ')
  84.             {
  85.                 Cmd.Append(' ');
  86.             }
  88.             Cmd.Append(switchName);
  89.         }
  91.         public void AppendSwitchIfNotNull(string switchName, string parameter)
  92.         {
  93.             if (string.IsNullOrEmpty(switchName) || string.IsNullOrEmpty(parameter))
  94.                 return;
  96.             AppendSwitch(switchName);
  97.             AppendTextWithQuoting(parameter);
  98.         }
  100.         public override string ToString() => Cmd.ToString();
  101.     }
  102. }

型
则重写的GetKeystoreGenerationCommand变为

  1. public static string GetKeystoreGenerationCommand(AndroidKeystoreData d)
  2. {
  3.     string cert = GetKeystoreCertificateInputString(d);
  4.     string keytool =  "%JAVA_HOME%\\bin\\keytool" ;// GetKeytoolPath();
  5.     string days = (d.ValidityInYears * 365).ToString();
  7.     if (!string.IsNullOrEmpty(cert)) cert = d.KeyAlias;
  9.     var cmd = new CommandArgumentsBuilder();
  11.     cmd.AppendSwitch("echo y | " + keytool);
  12.     cmd.AppendSwitch("-genkeypair");
  14.     cmd.AppendSwitchIfNotNull("-dname", cert);
  16.     cmd.AppendSwitchIfNotNull("-alias", d.KeyAlias);
  17.     cmd.AppendSwitchIfNotNull("-keypass", d.KeyPassword);
  18.     cmd.AppendSwitchIfNotNull("-storepass", d.Password);
  19.     cmd.AppendSwitchIfNotNull("-keystore", d.KeystorePath);
  20.     cmd.AppendSwitchIfNotNull("-validity", days);
  22.     return cmd.ToString();
  23. }

型

.net

1条答案

按热度按时间
92vpleto

92vpleto1#

我相信，如果您不想让用户注入shell命令，那么直接调用keytool二进制文件而不是cmd.exe就可以了。

赞(0）分享  回复(0）举报  2023-11-20
我来回答

相关问题

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新问答

    更多
    • 蜀ICP备13028337号-1 大数据知识库 https://www.saoniuhuo.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com