openbadgeslib 4.4.3__tar.gz → 4.4.4__tar.gz

{openbadgeslib-4.4.3 → openbadgeslib-4.4.4}/Changelog.txt

@@ -4,6 +4,32 @@ OpenBadgesLib - Changelog
 Newest first. Dates are ISO 8601 (YYYY-MM-DD).
 
 
+* v4.4.4 - 2026-09-10
+
+  - security(baking): SVG baking strips ``<script>`` / ``foreignObject`` /
+    event-handler attributes and ``javascript:`` / hostile ``data:`` URLs
+    from the carrier so a source image cannot turn a baked badge into an
+    XSS gadget.
+  - security(ob3): ``ecdsa-sd-2023`` presentations that omit ``validUntil``
+    or ``credentialStatus`` fail closed — a holder can no longer hide expiry
+    or revocation behind selective disclosure.
+  - security(oid4vci): explicit ``credential_endpoint`` / ``token_endpoint``
+    / ``nonce_endpoint`` overrides must be absolute ``https://`` URLs, not
+    plaintext HTTP.
+  - security(cli): ``signer.log`` is created and kept at mode ``0600``
+    (recipient emails); a file inherited from a permissive umask is
+    tightened on the next append.
+  - security(ci): wiki-sync authenticates clone/push with an HTTP extraheader
+    instead of embedding ``GITHUB_TOKEN`` in the git remote URL.
+  - security(mail): SMTP connections time out after 30 s; plaintext SMTP to
+    a non-loopback host is upgraded with STARTTLS (validating context).
+  - security(util): ``allow_insecure=True`` HTTP downloads pin the connect
+    IP the same way HTTPS already did (DNS rebinding).
+  - security(oid4vci): a live PIN-gated offer presented without ``tx_code``
+    returns the same ``invalid_grant`` as an unknown code, so the token
+    endpoint is not an oracle for which offers are PIN-gated.
+
+
 * v4.4.3 - 2026-08-18
 
   - security(oid4vci): an issuer that advertises

{openbadgeslib-4.4.3 → openbadgeslib-4.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openbadgeslib
-Version: 4.4.3
+Version: 4.4.4
 Summary: Production-ready Python library & CLI for Open Badges 3.0 (W3C Verifiable Credentials): issue, verify, and revoke JWT-VC credentials with Bitstring Status Lists and did:web — plus strict OB 2.0 and legacy OB 1.0.
 Author-email: Luis González Fernández <luisgf@luisgf.es>, Jesús Cea Avión <jcea@jcea.es>
 License: LGPLv3

{openbadgeslib-4.4.3 → openbadgeslib-4.4.4}/openbadgeslib/baking.py

@@ -29,7 +29,7 @@
 from struct import pack
 from zlib import crc32
 
-from typing import List, Optional, Tuple, Union, cast
+from typing import Any, List, Optional, Tuple, Union, cast
 
 from defusedxml.minidom import parseString
 from png import Reader, signature as _png_signature
@@ -76,6 +76,66 @@ def _bounded_inflate(data: bytes, limit: int = MAX_ITXT_DECOMPRESSED) -> bytes:
 
 # ── SVG ─────────────────────────────────────────────────────────────────────
 
+# Active content stripped from the carrier at bake time. A baked badge is an
+# image a recipient may open in a browser; leaving <script>, on* handlers or
+# javascript: URLs in the source SVG would execute in that context (#328).
+# `opacity` is the one SVG presentation attribute whose local name starts
+# with "on" and is not an event handler.
+_ACTIVE_SVG_ELEMENTS = frozenset({
+    'script', 'foreignobject', 'iframe', 'embed', 'object', 'handler',
+})
+_URL_ATTRS = frozenset({'href', 'src', 'action'})
+_SAFE_DATA_IMAGE_TYPES = (
+    'image/png', 'image/jpeg', 'image/jpg', 'image/gif', 'image/webp',
+)
+
+
+def _svg_local_name(node: Any) -> str:
+    return str(node.tagName).split(':')[-1].lower()
+
+
+def _iter_svg_elements(node: Any) -> List[Any]:
+    found: List[Any] = []
+    if getattr(node, 'nodeType', None) == node.ELEMENT_NODE:
+        found.append(node)
+        for child in list(node.childNodes):
+            found.extend(_iter_svg_elements(child))
+    return found
+
+
+def _is_active_url(value: str) -> bool:
+    """True for javascript:/vbscript: and for data: that is not a raster image."""
+    lowered = value.strip().lower()
+    if lowered.startswith('javascript:') or lowered.startswith('vbscript:'):
+        return True
+    if not lowered.startswith('data:'):
+        return False
+    payload = lowered[5:]
+    return not any(payload.startswith(kind) for kind in _SAFE_DATA_IMAGE_TYPES)
+
+
+def _strip_svg_active_content(root: Any) -> None:
+    """Drop script-class elements, on* handlers and active URLs under *root*."""
+    if root is None:
+        return
+    for el in _iter_svg_elements(root):
+        if _svg_local_name(el) in _ACTIVE_SVG_ELEMENTS:
+            parent = el.parentNode
+            if parent is not None:
+                parent.removeChild(el)
+    for el in _iter_svg_elements(root):
+        attrs = el.attributes
+        if attrs is None:
+            continue
+        for name in list(attrs.keys()):
+            local = name.split(':')[-1].lower()
+            if local.startswith('on') and local != 'opacity':
+                el.removeAttribute(name)
+                continue
+            if local in _URL_ATTRS and _is_active_url(attrs[name].value):
+                el.removeAttribute(name)
+
+
 def bake_svg(image_bytes: bytes, token: str, comment: Optional[str] = None, *,
              element: str = SVG_ELEMENT, namespace: str = SVG_NS,
              as_text: bool = False) -> bytes:
@@ -87,10 +147,15 @@ def bake_svg(image_bytes: bytes, token: str, comment: Optional[str] = None, *,
     instead of the ``verify`` attribute — the OB 3.0 carrier for credentials
     secured with a Data Integrity proof, whose payload is a JSON document
     rather than a compact JWT (OB 3.0 §5.3).
+
+    Active content in the source SVG (``<script>``, event-handler attributes,
+    ``javascript:`` / hostile ``data:`` URLs) is stripped before the token is
+    attached, so the baked carrier is not an XSS gadget (#328).
     """
     svg_doc = parseString(image_bytes)
     try:
         svg_tag = svg_doc.getElementsByTagName('svg').item(0)
+        _strip_svg_active_content(svg_tag)
         node = svg_doc.createElement(element)
         node.attributes['xmlns:openbadges'] = namespace
         if as_text:

{openbadgeslib-4.4.3 → openbadgeslib-4.4.4}/openbadgeslib/confparser.py

@@ -305,7 +305,15 @@ def oid4vci_config(conf: ConfigParser) -> OID4VCIConfig:
 
     def endpoint(key: str, default_path: str) -> str:
         explicit = (section.get(key) or '').strip() if section else ''
-        return explicit or urljoin(endpoint_base, default_path)
+        url = explicit or urljoin(endpoint_base, default_path)
+        # Derived endpoints inherit https from credential_issuer; an explicit
+        # override can be any string, and a plaintext http URL would advertise
+        # a token/credential/nonce endpoint wallets POST secrets to (#328).
+        if not url.startswith('https://'):
+            raise ConfigError(
+                "[oid4vci] %s must be an absolute https URL, got %r"
+                % (key, url))
+        return url
 
     store_path = (section.get('store_path') if section else None) or \
         os.path.join(conf['paths']['base'], 'oid4vci.sqlite3')

{openbadgeslib-4.4.3 → openbadgeslib-4.4.4}/openbadgeslib/mail.py

@@ -33,6 +33,18 @@ from email.header import Header
 from .badge_model import BadgeImgType   # version-neutral model (was ob1.badge)
 from .errors import BadgeImgFormatUnsupported
 
+#: Per-operation socket timeout for SMTP connect/read/write. smtplib's
+#: default is None (block forever).
+SMTP_TIMEOUT_SECONDS = 30
+
+
+def _smtp_is_loopback(host: str) -> bool:
+    """True for the hostnames/addresses operators use for a local MTA."""
+    name = host.strip().lower()
+    if name.startswith('[') and name.endswith(']'):
+        name = name[1:-1]
+    return name in ('localhost', '127.0.0.1', '::1')
+
 
 class BadgeMail():
     def __init__(self, smtp_server: str = 'localhost', smtp_port: int = 25,
@@ -83,9 +95,17 @@ class BadgeMail():
                 # CERT_NONE), which would let an on-path attacker intercept the
                 # connection and capture the AUTH credentials sent below.
                 smtp = SMTP_SSL(self.smtp_server, self.smtp_port,
+                                timeout=SMTP_TIMEOUT_SECONDS,
                                 context=ssl.create_default_context())
             else:
-                smtp = SMTP(self.smtp_server, self.smtp_port)
+                smtp = SMTP(self.smtp_server, self.smtp_port,
+                            timeout=SMTP_TIMEOUT_SECONDS)
+                # Plain SMTP to a non-loopback host is upgraded with STARTTLS
+                # so the message (and any later AUTH) is not sent in the
+                # clear. localhost is left alone: a local MTA often has no
+                # TLS listener on :25 (#328).
+                if not _smtp_is_loopback(self.smtp_server):
+                    smtp.starttls(context=ssl.create_default_context())
 
             if self.username:
                 smtp.login(self.username, self.password)

{openbadgeslib-4.4.3 → openbadgeslib-4.4.4}/openbadgeslib/ob3/ldp.py

@@ -453,6 +453,29 @@ def _reject_unsigned_ldp_aliases(doc: dict[str, Any]) -> None:
                 "not sign; use BitstringStatusListEntry")
 
 
+def _reject_hidden_sd_lifecycle(doc: dict[str, Any], proof: dict[str, Any]) -> None:
+    """Fail closed when an ecdsa-sd-2023 presentation omits lifecycle claims.
+
+    Selective disclosure lets a holder drop statements the issuer signed.
+    ``validUntil`` and ``credentialStatus`` are the ones that bound a badge's
+    life: hiding them makes an expired or revoked credential look perpetual.
+    eddsa-rdfc-2022 signs the whole document, so this only applies to
+    ecdsa-sd-2023. The low-level ``verify_data_integrity_proof`` does not
+    enforce it (it checks the proof alone); ``OB3LdpVerifier.verify`` does
+    (#328).
+    """
+    if proof.get('cryptosuite') != 'ecdsa-sd-2023':
+        return
+    if 'validUntil' not in doc:
+        raise OB3VerificationError(
+            "ecdsa-sd-2023 presentation omitted validUntil, which a holder "
+            "could hide to un-expire the badge; disclose validUntil")
+    if 'credentialStatus' not in doc:
+        raise OB3VerificationError(
+            "ecdsa-sd-2023 presentation omitted credentialStatus, which a "
+            "holder could hide to un-revoke the badge; disclose credentialStatus")
+
+
 class OB3LdpVerifier:
     """Verifies OpenBadges 3.0 credentials secured with a Data Integrity
     (Linked Data Proof) embedded proof — cryptosuites eddsa-rdfc-2022 and,
@@ -511,7 +534,9 @@ class OB3LdpVerifier:
         own signature is verified too (reusing a pinned key, or resolving the
         issuer DID), unless ``verify_status_list=False``. ``download`` resolves
         a did:web verificationMethod and status list issuer DID (injectable for
-        testing).
+        testing). An ``ecdsa-sd-2023`` presentation that omits ``validUntil``
+        or ``credentialStatus`` is rejected so a holder cannot hide expiry or
+        revocation (#328).
         """
         doc = self._parse_document(document)
 
@@ -528,6 +553,9 @@ class OB3LdpVerifier:
 
         proof = _select_proof(doc)
         _validate_proof(proof, 'assertionMethod')
+        # Before resolving keys or running crypto: an SD presentation that hid
+        # expiry/revocation is already a fail, regardless of the proof.
+        _reject_hidden_sd_lifecycle(doc, proof)
 
         vm = proof['verificationMethod']
         vm_did = vm.partition('#')[0]

{openbadgeslib-4.4.3 → openbadgeslib-4.4.4}/openbadgeslib/oid4vci/errors.py

@@ -76,7 +76,10 @@ INVALID_NONCE = 'invalid_nonce'
 INVALID_ENCRYPTION_PARAMETERS = 'invalid_encryption_parameters'
 #: The pre-authorized code was unknown, expired, already redeemed or killed.
 INVALID_GRANT = 'invalid_grant'
-#: The token request itself was malformed (missing tx_code, bad grant type).
+#: The token request itself was malformed (bad grant type, empty code).
+#: A live PIN-gated offer missing tx_code is invalid_grant, not this — the
+#: distinct invalid_request was an oracle that the offer exists and is
+#: PIN-gated (#328).
 INVALID_REQUEST = 'invalid_request'
 #: The access token was missing, unknown or expired. Served as HTTP 401 with a
 #: ``WWW-Authenticate: Bearer`` header, per RFC 6750 — not 400.

{openbadgeslib-4.4.3 → openbadgeslib-4.4.4}/openbadgeslib/oid4vci/handler.py

@@ -132,10 +132,11 @@ def handle_token_request(conf: configparser.ConfigParser, *, code: str,
     asking them to rebuild the part that is easy to get wrong.
 
     Raises :class:`OID4VCIError`. Unknown, expired, already-redeemed and
-    invalidated codes all produce the SAME ``invalid_grant`` with the same
+    invalidated codes, and a live PIN-gated offer presented without
+    ``tx_code``, all produce the SAME ``invalid_grant`` with the same
     message and, by way of :func:`~openbadgeslib.oid4vci.codes.
     dummy_tx_verification`, in the same time — otherwise the endpoint becomes
-    an oracle for which codes exist.
+    an oracle for which codes exist and which of them are PIN-gated.
     """
     moment = now or datetime.now(tz=timezone.utc)
     cfg = oid4vci_config(conf)
@@ -167,8 +168,10 @@ def handle_token_request(conf: configparser.ConfigParser, *, code: str,
 
     if grant.requires_tx_code:
         if not tx_code:
-            raise OID4VCIError(INVALID_REQUEST,
-                               'this offer requires a tx_code')
+            # Same invalid_grant as an unknown code: answering invalid_request
+            # here advertised that this live offer is PIN-gated (#328).
+            dummy_tx_verification()
+            raise OID4VCIError(INVALID_GRANT, _GRANT_REJECTED)
         assert grant.tx_code_kdf is not None
         assert grant.tx_code_salt is not None and grant.tx_code_digest is not None
         if not verify_tx_code(tx_code, grant.tx_code_kdf, grant.tx_code_salt,

{openbadgeslib-4.4.3 → openbadgeslib-4.4.4}/openbadgeslib/openbadges_signer.py

@@ -58,6 +58,30 @@ from .cli_common import (config_parser, debug_parser, json_parser,
 
 logger = logging.getLogger(__name__)
 
+
+def _append_signer_log(path: str, line: str) -> None:
+    """Append *line* to the signer audit log with owner-only permissions.
+
+    signer.log names recipients. Creating it with the process umask (often
+    0o022 → 0644) would leave those addresses group/world readable. ``O_CREAT``
+    uses 0o600 and ``fchmod`` tightens an already-existing file. Windows has
+    no ``fchmod`` and NTFS ACLs are the control there, so the dance is
+    skipped — same stance as ``_write_pem_file`` (#328).
+    """
+    flags = os.O_WRONLY | os.O_CREAT | os.O_APPEND
+    fd = os.open(path, flags, 0o600)
+    try:
+        if hasattr(os, 'fchmod'):
+            os.fchmod(fd, 0o600)
+        with os.fdopen(fd, 'a') as f:
+            fd = -1
+            f.write(line + '\n')
+    except Exception:
+        if fd >= 0:
+            os.close(fd)
+        raise
+
+
 # Entry Point
 
 
@@ -253,8 +277,7 @@ def _write_badge_and_log(conf: configparser.ConfigParser, badge_file_out: str,
         # KeyError, and the badge is already on disk — a log failure must be
         # reported, not turned into a traceback that loses the written badge.
         sign_log = os.path.join(conf['paths']['base_log'], conf['logs']['signer'])
-        with open(sign_log, 'a') as file:
-            file.write(msg + '\n')
+        _append_signer_log(sign_log, msg)
     except (OSError, KeyError) as err:
         print('[!] Could not write sign log: %s' % err)
     print('%s at: %s' % (msg, badge_file_out))
@@ -368,8 +391,7 @@ def _sign_ob1(args: argparse.Namespace, conf: configparser.ConfigParser, badge:
             % (datetime.today().isoformat(), badge,
                badge_signed.get_identity(), badge_signed.get_serial_num())
         try:
-            with open(sign_log, 'a') as file:
-                file.write(msg + '\n')
+            _append_signer_log(sign_log, msg)
         except OSError as err:
             print('[!] Could not write sign log: %s' % err)
 

{openbadgeslib-4.4.3 → openbadgeslib-4.4.4}/openbadgeslib/util.py

@@ -21,7 +21,7 @@
         License along with this library.
 """
 
-__version__ = '4.4.3'
+__version__ = '4.4.4'
 
 import contextlib
 import hashlib
@@ -220,6 +220,43 @@ class _HTTPSOnlyRedirectHandler(request.HTTPRedirectHandler):
         return super().redirect_request(req, fp, code, msg, headers, newurl)
 
 
+@contextlib.contextmanager
+def _pinned_dial(conn: http.client.HTTPConnection, default_port: int,
+                 allow_private: bool) -> Any:
+    """Resolve *conn.host*, SSRF-validate, and dial the validated IP.
+
+    Shared by the HTTPS and (allow_insecure) HTTP connection classes so a
+    name that answers public at the pre-check and private at connect (DNS
+    rebinding) is caught on both schemes (#328).
+    """
+    port = conn.port or default_port
+    try:
+        addrs = _resolve_host(conn.host, port)
+    except OSError as exc:
+        raise ValueError('Could not resolve host %r: %s'
+                         % (conn.host, exc)) from exc
+    if not addrs:
+        raise ValueError('Could not resolve host %r' % conn.host)
+    if not allow_private:
+        for ip_str in addrs:
+            if _ip_is_blocked(ip_str):
+                raise ValueError(
+                    'Refusing to connect to %r: resolves to non-public '
+                    'address %s (possible SSRF / DNS rebinding).'
+                    % (conn.host, ip_str))
+    pinned = addrs[0]
+    original = getattr(conn, '_create_connection')
+
+    def _dial_pinned(address: Any, *a: Any, **k: Any) -> Any:
+        return original((pinned, address[1]), *a, **k)
+
+    setattr(conn, '_create_connection', _dial_pinned)
+    try:
+        yield
+    finally:
+        setattr(conn, '_create_connection', original)
+
+
 class _PinnedHTTPSConnection(http.client.HTTPSConnection):
     """An HTTPSConnection that resolves and SSRF-validates the host *at connect
     time* and dials the validated IP, while still presenting the original
@@ -239,37 +276,26 @@ class _PinnedHTTPSConnection(http.client.HTTPSConnection):
         self._allow_private = allow_private
 
     def connect(self) -> None:
-        port = self.port or 443
-        try:
-            addrs = _resolve_host(self.host, port)
-        except OSError as exc:
-            raise ValueError('Could not resolve host %r: %s'
-                             % (self.host, exc)) from exc
-        if not addrs:
-            raise ValueError('Could not resolve host %r' % self.host)
-        if not self._allow_private:
-            for ip_str in addrs:
-                if _ip_is_blocked(ip_str):
-                    raise ValueError(
-                        'Refusing to connect to %r: resolves to non-public '
-                        'address %s (possible SSRF / DNS rebinding).'
-                        % (self.host, ip_str))
-        # Dial the validated IP directly (no second resolution) by pointing the
-        # connection's socket factory at it, then delegate to the parent connect
-        # — which still uses self.host for TLS SNI, certificate verification and
-        # the Host header. urllib exposes _create_connection as an instance
-        # attribute precisely so it can be swapped like this.
-        pinned = addrs[0]
-        original = self._create_connection  # type: ignore[has-type]
-
-        def _dial_pinned(address: Any, *a: Any, **k: Any) -> Any:
-            return original((pinned, address[1]), *a, **k)
-
-        self._create_connection = _dial_pinned
-        try:
+        with _pinned_dial(self, 443, self._allow_private):
+            super().connect()
+
+
+class _PinnedHTTPConnection(http.client.HTTPConnection):
+    """HTTP twin of :class:`_PinnedHTTPSConnection` for ``allow_insecure=True``.
+
+    Without this, an http:// download skipped the connect-time pin and
+    re-resolved at dial, reopening the DNS-rebinding window the HTTPS path
+    closed (#328).
+    """
+
+    def __init__(self, host: str, *args: Any,
+                 allow_private: bool = False, **kwargs: Any) -> None:
+        super().__init__(host, *args, **kwargs)
+        self._allow_private = allow_private
+
+    def connect(self) -> None:
+        with _pinned_dial(self, 80, self._allow_private):
             super().connect()
-        finally:
-            self._create_connection = original
 
 
 class _PinnedHTTPSHandler(request.HTTPSHandler):
@@ -287,6 +313,18 @@ class _PinnedHTTPSHandler(request.HTTPSHandler):
             _PinnedHTTPSConnection, req, allow_private=self._allow_private)
 
 
+class _PinnedHTTPHandler(request.HTTPHandler):
+    """Route plain-HTTP connections through :class:`_PinnedHTTPConnection`."""
+
+    def __init__(self, allow_private: bool = False) -> None:
+        super().__init__()
+        self._allow_private = allow_private
+
+    def http_open(self, req: Any) -> Any:
+        return self.do_open(
+            _PinnedHTTPConnection, req, allow_private=self._allow_private)
+
+
 #: Verify keys, issuer documents, and revocation lists are all small JSON/PEM
 #: payloads; cap reads well above any legitimate size to bound memory use
 #: against an attacker-influenced URL serving an oversized/streamed response.
@@ -314,8 +352,10 @@ def download_file(url: str, allow_insecure: bool = False,
     list, an OB2 badge/issuer/revocationList URL), fetching a private/loopback/
     link-local target would be a server-side request forgery (SSRF) sink. Pass
     ``allow_private=True`` to permit internal hosts (e.g. a private deployment).
-    The check is re-applied to redirect targets. The response body is bounded to
-    MAX_DOWNLOAD_SIZE to limit memory use.
+    The check is re-applied to redirect targets. HTTPS always, and HTTP when
+    ``allow_insecure=True``, pin the socket to the validated IP (DNS
+    rebinding). The response body is bounded to MAX_DOWNLOAD_SIZE to limit
+    memory use.
     """
     u = urlparse(url)
 
@@ -331,11 +371,16 @@ def download_file(url: str, allow_insecure: bool = False,
         _assert_public_host(url)
 
     # _PinnedHTTPSHandler pins the connection to the validated IP (defeats DNS
-    # rebinding); the redirect handler re-applies the scheme/host checks to any
+    # rebinding); the HTTP twin does the same when allow_insecure permits
+    # plain HTTP. The redirect handler re-applies the scheme/host checks to any
     # 30x target (which then also connects through the pinned handler).
-    opener = request.build_opener(
+    handlers: List[Any] = [
         _PinnedHTTPSHandler(allow_private),
-        _HTTPSOnlyRedirectHandler(allow_insecure, allow_private))
+        _HTTPSOnlyRedirectHandler(allow_insecure, allow_private),
+    ]
+    if allow_insecure:
+        handlers.insert(0, _PinnedHTTPHandler(allow_private))
+    opener = request.build_opener(*handlers)
     deadline = time.monotonic() + MAX_DOWNLOAD_SECONDS
     with opener.open(url, timeout=30) as response:
         chunks = []

{openbadgeslib-4.4.3 → openbadgeslib-4.4.4}/openbadgeslib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openbadgeslib
-Version: 4.4.3
+Version: 4.4.4
 Summary: Production-ready Python library & CLI for Open Badges 3.0 (W3C Verifiable Credentials): issue, verify, and revoke JWT-VC credentials with Bitstring Status Lists and did:web — plus strict OB 2.0 and legacy OB 1.0.
 Author-email: Luis González Fernández <luisgf@luisgf.es>, Jesús Cea Avión <jcea@jcea.es>
 License: LGPLv3

{openbadgeslib-4.4.3 → openbadgeslib-4.4.4}/tests/test_baking.py

@@ -52,6 +52,38 @@ class TestSvg:
         with pytest.raises(Exception):
             extract_svg(b'<svg><unclosed>')
 
+    def test_script_and_handlers_are_stripped_from_the_carrier(self):
+        # A baked badge is opened as an image; leftover active content in the
+        # source SVG would run in the recipient's browser (#328).
+        src = (
+            b'<svg xmlns="http://www.w3.org/2000/svg">'
+            b'<script>alert(1)</script>'
+            b'<rect id="mark" onclick="alert(1)" opacity="0.5" width="1" height="1"/>'
+            b'<a href="javascript:alert(1)">x</a>'
+            b'<image href="data:image/png;base64,AAAA"/>'
+            b'</svg>'
+        )
+        baked = bake_svg(src, TOKEN)
+        assert b'<script' not in baked.lower()
+        assert b'onclick' not in baked.lower()
+        assert b'javascript:' not in baked.lower()
+        assert b'opacity="0.5"' in baked
+        assert b'data:image/png;base64,AAAA' in baked
+        assert extract_svg(baked) == TOKEN
+
+    def test_foreignobject_and_data_html_are_stripped(self):
+        src = (
+            b'<svg xmlns="http://www.w3.org/2000/svg">'
+            b'<foreignObject><body xmlns="http://www.w3.org/1999/xhtml">'
+            b'<p>x</p></body></foreignObject>'
+            b'<a href="data:text/html,%3Cscript%3Ealert(1)%3C/script%3E">x</a>'
+            b'</svg>'
+        )
+        baked = bake_svg(src, TOKEN)
+        assert b'foreignObject' not in baked and b'foreignobject' not in baked.lower()
+        assert b'data:text/html' not in baked.lower()
+        assert extract_svg(baked) == TOKEN
+
 
 # ── PNG ──────────────────────────────────────────────────────────────────────
 

{openbadgeslib-4.4.3 → openbadgeslib-4.4.4}/tests/test_cli_smoke.py

@@ -892,6 +892,32 @@ def test_signer_ob2_writes_file_and_log(tmp_path, capsys):
     assert (tmp_path / 'log' / 'signer.log').read_text().strip() != ''
 
 
+def test_signer_log_is_owner_only_under_permissive_umask(tmp_path):
+    # signer.log names recipients; creating it with umask 0 must still yield
+    # 0600, and an already-world-readable file must be tightened (#328).
+    import os
+    import stat
+    import pytest
+    if os.name == 'nt' or not hasattr(os, 'fchmod'):
+        pytest.skip('POSIX file-mode semantics; Windows uses ACLs')
+    from openbadgeslib import openbadges_signer
+    cfg = _write_ob2_sign_config(tmp_path)
+    log = tmp_path / 'log' / 'signer.log'
+    log.write_text('prior\n')
+    os.chmod(log, 0o644)
+    argv = ['openbadges-signer', '-c', str(cfg), '-b', '1',
+            '-r', 'recipient@example.com', '-o', str(tmp_path), '-V', '1', '-E']
+    old = os.umask(0)
+    try:
+        with patch('openbadgeslib.badge_model.download_file', return_value=b'data'), \
+                patch.object(sys, 'argv', argv):
+            openbadges_signer.main()
+    finally:
+        os.umask(old)
+    mode = stat.S_IMODE(log.stat().st_mode)
+    assert mode == 0o600, 'signer.log has mode %o, expected 0600' % mode
+
+
 def test_signer_ob2_mail_badge_sends(tmp_path):
     from unittest.mock import MagicMock
     from openbadgeslib import openbadges_signer

{openbadgeslib-4.4.3 → openbadgeslib-4.4.4}/tests/test_mail.py

@@ -41,14 +41,29 @@ class TestSend:
             smtp = smtp_cls.return_value
             mail.send(_badge())
         smtp.login.assert_not_called()
+        smtp.starttls.assert_not_called()   # localhost: no STARTTLS
         smtp.sendmail.assert_called_once()
         smtp.quit.assert_called_once()
+        assert smtp_cls.call_args.kwargs.get('timeout') == 30
         frm, to, body = smtp.sendmail.call_args.args
         assert frm == 'issuer@example.com' and to == 'r@example.com'
         assert 'Content-Disposition: attachment' in body
         assert 'filename="badge_1_r.svg"' in body or "filename=badge_1_r.svg" in body
         assert '\nBcc:' not in body
 
+    def test_non_loopback_plain_smtp_upgrades_with_starttls(self):
+        import ssl as ssl_mod
+        mail = _ready_mail(smtp_server='mail.example.com')
+        with patch('openbadgeslib.mail.SMTP') as smtp_cls:
+            smtp = smtp_cls.return_value
+            mail.send(_badge())
+        smtp.starttls.assert_called_once()
+        ctx = smtp.starttls.call_args.kwargs.get('context')
+        assert ctx is not None
+        assert ctx.check_hostname is True
+        assert ctx.verify_mode == ssl_mod.CERT_REQUIRED
+        smtp.sendmail.assert_called_once()
+
     def test_ssl_with_auth_logs_in(self):
         mail = _ready_mail(use_ssl=True, username='u', password='p')
         with patch('openbadgeslib.mail.SMTP_SSL') as ssl_cls, \
@@ -71,6 +86,7 @@ class TestSend:
         assert ctx is not None
         assert ctx.check_hostname is True
         assert ctx.verify_mode == ssl_mod.CERT_REQUIRED
+        assert ssl_cls.call_args.kwargs.get('timeout') == 30
 
     def test_smtp_error_is_reported_not_raised(self, capsys):
         from smtplib import SMTPException