mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-20 15:21:30 +02:00
Yogesh OjhaandClaude Opus 5
d8122ae9c1
A stored secret that failed to decrypt was used as if it were plaintext. unseal_headers handed the Fernet token back, so every run whose context carried auth sent `Authorization: gAAAAAB...` to the target and reported success. EncryptedJSON returned None, so a scan context's auth silently vanished and the run went out unauthenticated. load_proxy_endpoints returned an empty list, so a scan configured to go through a proxy went direct instead. Rotating SECRET_KEY was enough to trigger all three. decrypt_stored() now separates the two cases a lenient decrypt conflated. A value that carries no Fernet token was written before sealing shipped (2026-09-06) and is returned as it is. A value that carries one and will not open raises SecretDecryptionError, naming the header, the column or the proxy and what to do about it. A stage turns that into a failed activity with the message on it; the api answers 503 through a handler beside the existing DBAPIError one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X5roHYDYzSPRNaTkn8hSkJ
16 lines
269 B
Python
16 lines
269 B
Python
from shared.utils.crypto import (
|
|
SecretDecryptionError,
|
|
decrypt_secret,
|
|
decrypt_stored,
|
|
encrypt_secret,
|
|
try_decrypt,
|
|
)
|
|
|
|
__all__ = [
|
|
"SecretDecryptionError",
|
|
"decrypt_secret",
|
|
"decrypt_stored",
|
|
"encrypt_secret",
|
|
"try_decrypt",
|
|
]
|