Reject key that is invalid Base64

DESCRIPTION

@@ -1,6 +1,6 @@
 Package: AzureStor
 Title: Storage Management in 'Azure'
-Version: 3.7.1
+Version: 3.7.2
 Authors@R: c(
     person("Hong", "Ooi", , "hongooi73@gmail.com", role = c("aut", "cre")),
     person("Microsoft", role="cph")
@@ -31,4 +31,4 @@ Suggests:
     processx,
     uuid
 Roxygen: list(markdown=TRUE, r6=FALSE, old_usage=TRUE)
-RoxygenNote: 7.3.2
+Config/roxygen2/version: 8.1.0

NAMESPACE

@@ -236,7 +236,9 @@ export(upload_azure_file)
 export(upload_blob)
 export(upload_to_url)
 import(AzureRMR)
-importFrom(utils,URLencode)
-importFrom(utils,glob2rx)
-importFrom(utils,modifyList)
-importFrom(utils,packageVersion)
+importFrom(utils,
+  URLencode,
+  glob2rx,
+  modifyList,
+  packageVersion
+)

NEWS.md

@@ -1,3 +1,7 @@
+# AzureStor 3.7.2
+
+- Storage account key authentication and SAS generation will now always fail with a key that is invalid Base64-encoded, rather than generating a bad SAS. Also fixes #147.
+
 # AzureStor 3.7.1
 
 - Update documentation links for CRAN

R/sas.R

@@ -47,6 +47,8 @@
 #' [Create a service SAS](https://learn.microsoft.com/en-us/rest/api/storageservices/create-service-sas)
 #'
 #' @examples
+#' \dontrun{
+#'
 #' # account SAS valid for 7 days
 #' get_account_sas("mystorage", "access_key", start=Sys.Date(), expiry=Sys.Date() + 7)
 #'
@@ -72,8 +74,6 @@
 #' # read/write service SAS for a blob
 #' get_service_sas(endp, "containername/blobname", permissions="rw")
 #'
-#' \dontrun{
-#'
 #' # user delegation key valid for 24 hours
 #' token <- AzureRMR::get_azure_token("https://storage.azure.com", "mytenant", "app_id")
 #' endp <- storage_endpoint("https://mystorage.blob.core.windows.net", token=token)

R/storage_utils.R

@@ -272,7 +272,12 @@ render_xml <- function(lst)
 
 sign_sha256 <- function(string, key)
 {
-    openssl::base64_encode(openssl::sha256(charToRaw(string), openssl::base64_decode(key)))
+    # throw error on all invalid keys (consistent with behaviour in openssl 2.5.0)
+    key_decoded <- try(openssl::base64_decode(key))
+    if(inherits(key_decoded, "try-error") || length(key_decoded) == 0)
+        stop("Invalid storage account key, must be Base64 encoded", call.=FALSE)
+
+    openssl::base64_encode(openssl::sha256(charToRaw(string), key_decoded))
 }