awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-08 01:27:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

More tests

Browse Source
This commit is contained in:
Daniel Hougaard
2024-02-22 05:00:25 +01:00
parent 7ea5323a37
commit b0356ba941
2 changed files with 101 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/lib/secret/index.ts
+71 -42
View File
@@ -1,10 +1,10 @@
import crypto from "crypto"; import crypto from "crypto";
import { z } from "zod"; import { z } from "zod";
import { SecretKeyEncoding, TProjectKeys } from "@app/db/schemas"; import { TProjectKeys } from "@app/db/schemas";
import { decryptAsymmetric, decryptSymmetric } from "../crypto"; import { decryptAsymmetric } from "../crypto";
import { decryptSymmetric128BitHexKeyUTF8, TDecryptSymmetricInput } from "../crypto/encryption"; // import { decryptSymmetric128BitHexKeyUTF8, TDecryptSymmetricInput } from "../crypto/encryption";
export enum SecretDocType { export enum SecretDocType {
Secret = "secret", Secret = "secret",
@@ -43,38 +43,60 @@ const PartialDecryptedSecretSchema = z.object({
export type TPartialSecret = z.infer<typeof PartialSecretSchema>; export type TPartialSecret = z.infer<typeof PartialSecretSchema>;
export type TPartialDecryptedSecret = z.infer<typeof PartialDecryptedSecretSchema>; export type TPartialDecryptedSecret = z.infer<typeof PartialDecryptedSecretSchema>;
const symmetricDecrypt = ({ // const symmetricDecrypt = ({
keyEncoding, // keyEncoding,
ciphertext, // ciphertext,
tag, // tag,
iv, // iv,
key, // key,
isApprovalSecret // isApprovalSecret
}: TDecryptSymmetricInput & { keyEncoding: SecretKeyEncoding; isApprovalSecret: boolean }) => { // }: TDecryptSymmetricInput & { keyEncoding: SecretKeyEncoding; isApprovalSecret: boolean }) => {
try { // try {
if (keyEncoding === SecretKeyEncoding.UTF8 || isApprovalSecret) { // if (keyEncoding === SecretKeyEncoding.UTF8 || isApprovalSecret) {
const data = decryptSymmetric128BitHexKeyUTF8({ key, iv, tag, ciphertext }); // const data = decryptSymmetric128BitHexKeyUTF8({ key, iv, tag, ciphertext });
return data; // return data;
} // }
if (keyEncoding === SecretKeyEncoding.BASE64) { // if (keyEncoding === SecretKeyEncoding.BASE64) {
const data = decryptSymmetric({ key, iv, tag, ciphertext }); // const data = decryptSymmetric({ key, iv, tag, ciphertext });
return data; // return data;
} // }
throw new Error("BAD_ENCODING"); // throw new Error("BAD_ENCODING");
} catch (err) { // } catch (err) {
if (err instanceof Error && err.message === "BAD_ENCODING") { // if (err instanceof Error && err.message === "BAD_ENCODING") {
throw new Error("Invalid key encoding, cannot decrypt secret!"); // throw new Error("Invalid key encoding, cannot decrypt secret!");
} // }
// This is taken directly from our frontend secret decryption logic. // // This is taken directly from our frontend secret decryption logic.
// const decipher = crypto.createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "base64"));
// decipher.setAuthTag(Buffer.from(tag, "base64"));
// let data = decipher.update(ciphertext, "base64", "utf8");
// data += decipher.final("utf8");
// console.log(data);
// return data;
// }
// };
const decryptSecret = ({
ciphertext,
iv,
tag,
key
}: {
ciphertext: string;
iv: string;
tag: string;
key: string | Buffer;
}) => {
const decipher = crypto.createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "base64")); const decipher = crypto.createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "base64"));
decipher.setAuthTag(Buffer.from(tag, "base64")); decipher.setAuthTag(Buffer.from(tag, "base64"));
let data = decipher.update(ciphertext, "base64", "utf8"); let cleartext = decipher.update(ciphertext, "base64", "utf8");
data += decipher.final("utf8"); cleartext += decipher.final("utf8");
return data; return cleartext;
}
}; };
export const decryptSecrets = ( export const decryptSecrets = (
@@ -96,33 +118,36 @@ export const decryptSecrets = (
const secrets: TPartialDecryptedSecret[] = []; const secrets: TPartialDecryptedSecret[] = [];
encryptedSecrets.forEach((encSecret) => { encryptedSecrets.forEach((encSecret) => {
const secretKey = symmetricDecrypt({ try {
console.log(encSecret.keyEncoding);
const secretKey = decryptSecret({
ciphertext: encSecret.secretKeyCiphertext, ciphertext: encSecret.secretKeyCiphertext,
iv: encSecret.secretKeyIV, iv: encSecret.secretKeyIV,
tag: encSecret.secretKeyTag, tag: encSecret.secretKeyTag,
key, key
keyEncoding: encSecret.keyEncoding as SecretKeyEncoding, // keyEncoding: encSecret.keyEncoding as SecretKeyEncoding,
isApprovalSecret: encSecret.docType === SecretDocType.ApprovalSecret // isApprovalSecret: encSecret.docType === SecretDocType.ApprovalSecret
}); });
const secretValue = symmetricDecrypt({ const secretValue = decryptSecret({
ciphertext: encSecret.secretValueCiphertext, ciphertext: encSecret.secretValueCiphertext,
iv: encSecret.secretValueIV, iv: encSecret.secretValueIV,
tag: encSecret.secretValueTag, tag: encSecret.secretValueTag,
key, key
keyEncoding: encSecret.keyEncoding as SecretKeyEncoding, // keyEncoding: encSecret.keyEncoding as SecretKeyEncoding,
isApprovalSecret: encSecret.docType === SecretDocType.ApprovalSecret // isApprovalSecret: encSecret.docType === SecretDocType.ApprovalSecret
}); });
const secretComment = const secretComment =
encSecret.secretCommentCiphertext && encSecret.secretCommentIV && encSecret.secretCommentTag encSecret.secretCommentCiphertext && encSecret.secretCommentIV && encSecret.secretCommentTag
? symmetricDecrypt({ ? decryptSecret({
ciphertext: encSecret.secretCommentCiphertext, ciphertext: encSecret.secretCommentCiphertext,
iv: encSecret.secretCommentIV, iv: encSecret.secretCommentIV,
tag: encSecret.secretCommentTag, tag: encSecret.secretCommentTag,
key, key
keyEncoding: encSecret.keyEncoding as SecretKeyEncoding, // keyEncoding: encSecret.keyEncoding as SecretKeyEncoding,
isApprovalSecret: encSecret.docType === SecretDocType.ApprovalSecret // isApprovalSecret: encSecret.docType === SecretDocType.ApprovalSecret
}) })
: ""; : "";
@@ -135,6 +160,10 @@ export const decryptSecrets = (
}; };
secrets.push(decryptedSecret); secrets.push(decryptedSecret);
} catch (err) {
// This is ok, because we check that the decrypted secrets array length is the same as the encrypted secrets array length.
console.log(`[${encSecret.id}] - failed to decrypt`, err);
}
}); });
return secrets; return secrets;
backend/src/services/project/project-queue.ts
+6 -1
View File
@@ -143,7 +143,12 @@ export const projectQueueFactory = ({
secrets.push(...approvalSecrets.map((el) => ({ ...el, docType: SecretDocType.ApprovalSecret }))); secrets.push(...approvalSecrets.map((el) => ({ ...el, docType: SecretDocType.ApprovalSecret })));
} }
const decryptedSecrets = decryptSecrets(secrets, userPrivateKey, oldProjectKey); const decryptedSecrets = decryptSecrets(
// secrets.filter((s) => s.keyEncoding === "base64"),
secrets,
userPrivateKey,
oldProjectKey
);
console.log( console.log(
decryptedSecrets decryptedSecrets