Skip to content

Fix record encryptor trying to decrypt empty strings#7542

Merged
mrcasals merged 1 commit intodevelopfrom
fix/record-encryptor-empty-strings
Mar 5, 2021
Merged

Fix record encryptor trying to decrypt empty strings#7542
mrcasals merged 1 commit intodevelopfrom
fix/record-encryptor-empty-strings

Conversation

@mrcasals
Copy link
Copy Markdown
Contributor

@mrcasals mrcasals commented Mar 4, 2021

🎩 What? Why?

When an authorization has a Hash with an empty string, the decryption process fails. This Pr fixes it.

📌 Related Issues

Testing

Probably same as in #7488.

@mrcasals
Copy link
Copy Markdown
Contributor Author

mrcasals commented Mar 4, 2021

@ahukkanen care to check this out? 🙏

@mrcasals
Copy link
Copy Markdown
Contributor Author

mrcasals commented Mar 4, 2021

This needs to be backported to 0.24.

@ahukkanen
Copy link
Copy Markdown
Contributor

Looks good @mrcasals, your fix works fine!

I think this could've also been solved just by changing the order of these lines:

next value unless value.is_a?(String)
decrypted_value = decrypt_value(value)

To:

decrypted_value = decrypt_value(value)

next decrypted_value unless decrypted_value.is_a?(String)

This actually originates from this line which returns nil:

return if string_encrypted.blank?

I was actually thinking whether it's safe to return nil there but I didn't dare to change the behavior from the original one which also returned nil in case the value is blank:

cryptor.decrypt_and_verify(string_encrypted) if string_encrypted.present?

@mrcasals
Copy link
Copy Markdown
Contributor Author

mrcasals commented Mar 4, 2021

I think this could've also been solved just by changing the order of these lines:

I tried that, but then I get an error in the specs:

     Failure/Error: expect(subject.metadata).to eq(deep_metadata)

       expected: {"extras"=>{"foo"=>{"bar"=>"baz"}}, "foobar"=>"", "location"=>{"Country"=>{"Province"=>{"Region"=>{"Sub-region"=>{"Municipality"=>{"Quarter"=>{"Block"=>"Street"}}}}}}}}
            got: {"extras"=>{"foo"=>{"bar"=>"baz"}}, "foobar"=>nil, "location"=>{"Country"=>{"Province"=>{"Region"=>{"Sub-region"=>{"Municipality"=>{"Quarter"=>{"Block"=>"Street"}}}}}}}}

       (compared using ==)

       Diff:
       @@ -1,4 +1,4 @@
        "extras" => {"foo"=>{"bar"=>"baz"}},
       -"foobar" => "",
       +"foobar" => nil,
        "location" => {"Country"=>{"Province"=>{"Region"=>{"Sub-region"=>{"Municipality"=>{"Quarter"=>{"Block"=>"Street"}}}}}}},

And I didn't want the signature to change, that's why I left it as a rescue, although I'm not really happy about it...

@ahukkanen
Copy link
Copy Markdown
Contributor

I think in this case it is fine to change the expectation if we want the values to be changed to nil when they are empty as in:

return if string_encrypted.blank?

Or you could just return an empty string here but I'm not sure if it has some other consequences as I mentioned above...

Either way is fine, your solution is also good!

@mrcasals mrcasals merged commit 1ff0264 into develop Mar 5, 2021
@mrcasals mrcasals deleted the fix/record-encryptor-empty-strings branch March 5, 2021 07:35
entantoencuanto added a commit that referenced this pull request Mar 5, 2021
* develop:
  Fix infinite loop when impersonated session time runs out (#7221)
  New Crowdin updates (#7543)
  Migrate Admin menus to Menu Registry Part 2 (#7382)
  Replace xls with xlsx (#7421)
  Use cache_key_with_version instead of cache version (#7532)
  Add support for ElectionGuard voting scheme (#7454)
  Fix record encryptor trying to decrypt empty strings (#7542)
  Revert "Don't schedule CI jobs for locales PRs (#7534)" (#7546)
  New Crowdin updates (#7540)
  New Crowdin updates (#7539)
@leio10 leio10 added module: core type: fix PRs that implement a fix for a bug labels Jul 23, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

module: core type: fix PRs that implement a fix for a bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Can't migrate the DB after #6947

3 participants