mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-14 03:54:21 +00:00
4e3fd305ab
# Which Problems Are Solved We noticed logging where 500: Internal Server errors were returned from the token endpoint, mostly for the `refresh_token` grant. The error was thrown by the database as it received non-UTF8 strings for token IDs Zitadel uses symmetric encryption for opaque tokens, including refresh tokens. Encrypted values are base64 encoded. It appeared to be possible to send garbage base64 to the token endpoint, which will pass decryption and string-splitting. In those cases the resulting ID is not a valid UTF-8 string. Invalid non-UTF8 strings are now rejected during token decryption. # How the Problems Are Solved - `AESCrypto.DecryptString()` checks if the decrypted bytes only contain valid UTF-8 characters before converting them into a string. - `AESCrypto.Decrypt()` is unmodified and still allows decryption on non-UTF8 byte strings. - `FromRefreshToken` now uses `DecryptString` instead of `Decrypt` # Additional Changes - Unit tests added for `FromRefreshToken` and `AESCrypto.DecryptString()`. - Fuzz tests added for `FromRefreshToken` and `AESCrypto.DecryptString()`. This was to pinpoint the problem - Testdata with values that resulted in invalid strings are committed. In the pipeline this results in the Fuzz tests to execute as regular unit-test cases. As we don't use the `-fuzz` flag in the pipeline no further fuzzing is performed. # Additional Context - Closes #7765 - https://go.dev/doc/tutorial/fuzz
110 lines
2.3 KiB
Go
110 lines
2.3 KiB
Go
package crypto
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"testing"
|
|
"unicode/utf8"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/zitadel/zitadel/internal/zerrors"
|
|
)
|
|
|
|
type mockKeyStorage struct {
|
|
keys Keys
|
|
}
|
|
|
|
func (s *mockKeyStorage) ReadKeys() (Keys, error) {
|
|
return s.keys, nil
|
|
}
|
|
|
|
func (s *mockKeyStorage) ReadKey(id string) (*Key, error) {
|
|
return &Key{
|
|
ID: id,
|
|
Value: s.keys[id],
|
|
}, nil
|
|
}
|
|
|
|
func (*mockKeyStorage) CreateKeys(context.Context, ...*Key) error {
|
|
return errors.New("mockKeyStorage.CreateKeys not implemented")
|
|
}
|
|
|
|
func newTestAESCrypto(t testing.TB) *AESCrypto {
|
|
keyConfig := &KeyConfig{
|
|
EncryptionKeyID: "keyID",
|
|
DecryptionKeyIDs: []string{"keyID"},
|
|
}
|
|
keys := Keys{"keyID": "ThisKeyNeedsToHave32Characters!!"}
|
|
aesCrypto, err := NewAESCrypto(keyConfig, &mockKeyStorage{keys: keys})
|
|
require.NoError(t, err)
|
|
return aesCrypto
|
|
}
|
|
|
|
func TestAESCrypto_DecryptString(t *testing.T) {
|
|
aesCrypto := newTestAESCrypto(t)
|
|
const input = "SecretData"
|
|
crypted, err := aesCrypto.Encrypt([]byte(input))
|
|
require.NoError(t, err)
|
|
|
|
type args struct {
|
|
value []byte
|
|
keyID string
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
args args
|
|
want string
|
|
wantErr error
|
|
}{
|
|
{
|
|
name: "unknown key id error",
|
|
args: args{
|
|
value: crypted,
|
|
keyID: "foo",
|
|
},
|
|
wantErr: zerrors.ThrowNotFound(nil, "CRYPT-nkj1s", "unknown key id"),
|
|
},
|
|
{
|
|
name: "ok",
|
|
args: args{
|
|
value: crypted,
|
|
keyID: "keyID",
|
|
},
|
|
want: input,
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
got, err := aesCrypto.DecryptString(tt.args.value, tt.args.keyID)
|
|
require.ErrorIs(t, err, tt.wantErr)
|
|
assert.Equal(t, tt.want, got)
|
|
}
|
|
}
|
|
|
|
func FuzzAESCrypto_DecryptString(f *testing.F) {
|
|
aesCrypto := newTestAESCrypto(f)
|
|
tests := []string{
|
|
" ",
|
|
"SecretData",
|
|
"FooBar",
|
|
"HelloWorld",
|
|
}
|
|
for _, input := range tests {
|
|
tc, err := aesCrypto.Encrypt([]byte(input))
|
|
require.NoError(f, err)
|
|
f.Add(tc)
|
|
}
|
|
f.Fuzz(func(t *testing.T, value []byte) {
|
|
got, err := aesCrypto.DecryptString(value, "keyID")
|
|
if errors.Is(err, zerrors.ThrowPreconditionFailed(nil, "CRYPT-23kH1", "cipher text block too short")) {
|
|
return
|
|
}
|
|
if errors.Is(err, zerrors.ThrowPreconditionFailed(nil, "CRYPT-hiCh0", "non-UTF-8 in decrypted string")) {
|
|
return
|
|
}
|
|
require.NoError(t, err)
|
|
assert.True(t, utf8.ValidString(got), "result is not valid UTF-8")
|
|
})
|
|
}
|