Skip to content

Commit f2a4c7a

Browse files
committed
Add some comments on validating encryption context.
1 parent 8199e0a commit f2a4c7a

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

src/main/java/software/amazon/encryption/s3/materials/KmsKeyring.java

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -125,10 +125,11 @@ public byte[] decryptDataKey(DecryptionMaterials materials, byte[] encryptedData
125125
}
126126
}
127127

128-
Map<String, String> materialsEncryptionContext = new HashMap<>(materials.encryptionContext());
129-
materialsEncryptionContext.remove(KEY_ID_CONTEXT_KEY);
130-
materialsEncryptionContext.remove(ENCRYPTION_CONTEXT_ALGORITHM_KEY);
131-
if (!materialsEncryptionContext.equals(requestEncryptionContext)) {
128+
// We are validating the encryption context to match S3EC V2 behavior
129+
Map<String, String> materialsEncryptionContextCopy = new HashMap<>(materials.encryptionContext());
130+
materialsEncryptionContextCopy.remove(KEY_ID_CONTEXT_KEY);
131+
materialsEncryptionContextCopy.remove(ENCRYPTION_CONTEXT_ALGORITHM_KEY);
132+
if (!materialsEncryptionContextCopy.equals(requestEncryptionContext)) {
132133
throw new S3EncryptionClientException("Provided encryption context does not match information retrieved from S3");
133134
}
134135

0 commit comments

Comments
 (0)