intel / intel/confidential-computing.tee.dcap
PCSClientTool depends on order of elements in JSON response of PCS
- Dominant language
- C
- Stars
- 326
- Forks
- 198
- PR merge metrics
- No merged PRs in 30d
Description
The PCSClientTool does not follow [the JSON specification](https://www.json.org/json-en.html) when parsing the response of the PCS when retrieving QE/QVE/TD_QE identity.
Specifically this section performs manual parsing of the JSON data: https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/fa6631cb98cba8a97f9d544aa9bd9d7438f0db87/tools/PccsAdminTool/lib/intelsgx/pcs.py#L691-L697
This code only works correctly when the response is ordered like the following:
```
{
"tcbInfo": {
//...
},
"signature"; ""
}
```
This only works correctly when the JSON data returned by the PCS always follows the same order, which seems to be no longer the case.
It is also not guaranteed by the JSON specification.
To quote from the specification:
> JSON is built on two structures:
> A collection of name/value pairs. In various languages, this is realized as an object, record, struct, dictionary, hash table, keyed list, or associative array.
> An ordered list of values. In most languages, this is realized as an array, vector, list, or sequence.
Since the PCS does not return an ordered list (array), but a collection of name/value pairs, the PCSClientTool should not depend on the ordering of said values.
Contributor guide
Research direction
Start with the manual JSON parsing in tools/PccsAdminTool/lib/intelsgx/pcs.py around lines 691-697. Reproduce QE/QVE/TD_QE identity retrieval with the PCS response fields in a different order, then verify the tool handles both response orders correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100