mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-21 07:41:28 +02:00
Yogesh OjhaandClaude Opus 5
d8122ae9c1
A stored secret that failed to decrypt was used as if it were plaintext. unseal_headers handed the Fernet token back, so every run whose context carried auth sent `Authorization: gAAAAAB...` to the target and reported success. EncryptedJSON returned None, so a scan context's auth silently vanished and the run went out unauthenticated. load_proxy_endpoints returned an empty list, so a scan configured to go through a proxy went direct instead. Rotating SECRET_KEY was enough to trigger all three. decrypt_stored() now separates the two cases a lenient decrypt conflated. A value that carries no Fernet token was written before sealing shipped (2026-09-06) and is returned as it is. A value that carries one and will not open raises SecretDecryptionError, naming the header, the column or the proxy and what to do about it. A stage turns that into a failed activity with the message on it; the api answers 503 through a handler beside the existing DBAPIError one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X5roHYDYzSPRNaTkn8hSkJ
29 lines
776 B
Python
29 lines
776 B
Python
"""Column types that keep a value encrypted at rest."""
|
|
|
|
import json
|
|
|
|
from sqlalchemy import Text, TypeDecorator
|
|
|
|
from shared.utils.crypto import decrypt_stored, encrypt_secret
|
|
|
|
|
|
class EncryptedJSON(TypeDecorator):
|
|
"""A JSON value stored as a Fernet token."""
|
|
|
|
impl = Text
|
|
cache_ok = True
|
|
|
|
def process_bind_param(self, value, dialect): # noqa: ARG002
|
|
if value is None:
|
|
return None
|
|
return encrypt_secret(json.dumps(value))
|
|
|
|
def process_result_value(self, value, dialect): # noqa: ARG002
|
|
if value is None:
|
|
return None
|
|
plain = decrypt_stored(value, label="A stored configuration value")
|
|
try:
|
|
return json.loads(plain)
|
|
except (TypeError, ValueError):
|
|
return None
|