Skip to content

Commit 55fc704

Browse files
sweatybridgesweatybridge
authored
fix: skip hashing unloaded env reference (#3029)
* fix: skip hashing unloaded env reference * fix: zero maps and arrays before unmarshaling
1 parent 88cd609 commit 55fc704

File tree

3 files changed

+38
-38
lines changed

3 files changed

+38
-38
lines changed

‎pkg/config/auth.go‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -265,23 +265,23 @@ func (h hook) toAuthConfigBody(body *v1API.UpdateAuthConfigBody) {
265265
if hook := h.CustomAccessToken; hook != nil {
266266
if body.HookCustomAccessTokenEnabled = &hook.Enabled; hook.Enabled {
267267
body.HookCustomAccessTokenUri = &hook.URI
268-
if len(hook.Secrets.Value) > 0 {
268+
if len(hook.Secrets.SHA256) > 0 {
269269
body.HookCustomAccessTokenSecrets = &hook.Secrets.Value
270270
}
271271
}
272272
}
273273
if hook := h.SendEmail; hook != nil {
274274
if body.HookSendEmailEnabled = &hook.Enabled; hook.Enabled {
275275
body.HookSendEmailUri = &hook.URI
276-
if len(hook.Secrets.Value) > 0 {
276+
if len(hook.Secrets.SHA256) > 0 {
277277
body.HookSendEmailSecrets = &hook.Secrets.Value
278278
}
279279
}
280280
}
281281
if hook := h.SendSMS; hook != nil {
282282
if body.HookSendSmsEnabled = &hook.Enabled; hook.Enabled {
283283
body.HookSendSmsUri = &hook.URI
284-
if len(hook.Secrets.Value) > 0 {
284+
if len(hook.Secrets.SHA256) > 0 {
285285
body.HookSendSmsSecrets = &hook.Secrets.Value
286286
}
287287
}
@@ -290,15 +290,15 @@ func (h hook) toAuthConfigBody(body *v1API.UpdateAuthConfigBody) {
290290
if hook := h.MFAVerificationAttempt; hook != nil {
291291
if body.HookMfaVerificationAttemptEnabled = &hook.Enabled; hook.Enabled {
292292
body.HookMfaVerificationAttemptUri = &hook.URI
293-
if len(hook.Secrets.Value) > 0 {
293+
if len(hook.Secrets.SHA256) > 0 {
294294
body.HookMfaVerificationAttemptSecrets = &hook.Secrets.Value
295295
}
296296
}
297297
}
298298
if hook := h.PasswordVerificationAttempt; hook != nil {
299299
if body.HookPasswordVerificationAttemptEnabled = &hook.Enabled; hook.Enabled {
300300
body.HookPasswordVerificationAttemptUri = &hook.URI
301-
if len(hook.Secrets.Value) > 0 {
301+
if len(hook.Secrets.SHA256) > 0 {
302302
body.HookPasswordVerificationAttemptSecrets = &hook.Secrets.Value
303303
}
304304
}
@@ -512,7 +512,7 @@ func (s smtp) toAuthConfigBody(body *v1API.UpdateAuthConfigBody) {
512512
body.SmtpHost = &s.Host
513513
body.SmtpPort = cast.Ptr(strconv.Itoa(int(s.Port)))
514514
body.SmtpUser = &s.User
515-
if len(s.Pass.Value) > 0 {
515+
if len(s.Pass.SHA256) > 0 {
516516
body.SmtpPass = &s.Pass.Value
517517
}
518518
body.SmtpAdminEmail = &s.AdminEmail
@@ -556,33 +556,33 @@ func (s sms) toAuthConfigBody(body *v1API.UpdateAuthConfigBody) {
556556
switch {
557557
case s.Twilio.Enabled:
558558
body.SmsProvider = cast.Ptr("twilio")
559-
if len(s.Twilio.AuthToken.Value) > 0 {
559+
if len(s.Twilio.AuthToken.SHA256) > 0 {
560560
body.SmsTwilioAuthToken = &s.Twilio.AuthToken.Value
561561
}
562562
body.SmsTwilioAccountSid = &s.Twilio.AccountSid
563563
body.SmsTwilioMessageServiceSid = &s.Twilio.MessageServiceSid
564564
case s.TwilioVerify.Enabled:
565565
body.SmsProvider = cast.Ptr("twilio_verify")
566-
if len(s.TwilioVerify.AuthToken.Value) > 0 {
566+
if len(s.TwilioVerify.AuthToken.SHA256) > 0 {
567567
body.SmsTwilioVerifyAuthToken = &s.TwilioVerify.AuthToken.Value
568568
}
569569
body.SmsTwilioVerifyAccountSid = &s.TwilioVerify.AccountSid
570570
body.SmsTwilioVerifyMessageServiceSid = &s.TwilioVerify.MessageServiceSid
571571
case s.Messagebird.Enabled:
572572
body.SmsProvider = cast.Ptr("messagebird")
573-
if len(s.Messagebird.AccessKey.Value) > 0 {
573+
if len(s.Messagebird.AccessKey.SHA256) > 0 {
574574
body.SmsMessagebirdAccessKey = &s.Messagebird.AccessKey.Value
575575
}
576576
body.SmsMessagebirdOriginator = &s.Messagebird.Originator
577577
case s.Textlocal.Enabled:
578578
body.SmsProvider = cast.Ptr("textlocal")
579-
if len(s.Textlocal.ApiKey.Value) > 0 {
579+
if len(s.Textlocal.ApiKey.SHA256) > 0 {
580580
body.SmsTextlocalApiKey = &s.Textlocal.ApiKey.Value
581581
}
582582
body.SmsTextlocalSender = &s.Textlocal.Sender
583583
case s.Vonage.Enabled:
584584
body.SmsProvider = cast.Ptr("vonage")
585-
if len(s.Vonage.ApiSecret.Value) > 0 {
585+
if len(s.Vonage.ApiSecret.SHA256) > 0 {
586586
body.SmsVonageApiSecret = &s.Vonage.ApiSecret.Value
587587
}
588588
body.SmsVonageApiKey = &s.Vonage.ApiKey
@@ -647,15 +647,15 @@ func (e external) toAuthConfigBody(body *v1API.UpdateAuthConfigBody) {
647647
if p, ok := e["apple"]; ok {
648648
if body.ExternalAppleEnabled = &p.Enabled; *body.ExternalAppleEnabled {
649649
body.ExternalAppleClientId = &p.ClientId
650-
if len(p.Secret.Value) > 0 {
650+
if len(p.Secret.SHA256) > 0 {
651651
body.ExternalAppleSecret = &p.Secret.Value
652652
}
653653
}
654654
}
655655
if p, ok := e["azure"]; ok {
656656
if body.ExternalAzureEnabled = &p.Enabled; *body.ExternalAzureEnabled {
657657
body.ExternalAzureClientId = &p.ClientId
658-
if len(p.Secret.Value) > 0 {
658+
if len(p.Secret.SHA256) > 0 {
659659
body.ExternalAzureSecret = &p.Secret.Value
660660
}
661661
body.ExternalAzureUrl = &p.Url
@@ -664,47 +664,47 @@ func (e external) toAuthConfigBody(body *v1API.UpdateAuthConfigBody) {
664664
if p, ok := e["bitbucket"]; ok {
665665
if body.ExternalBitbucketEnabled = &p.Enabled; *body.ExternalBitbucketEnabled {
666666
body.ExternalBitbucketClientId = &p.ClientId
667-
if len(p.Secret.Value) > 0 {
667+
if len(p.Secret.SHA256) > 0 {
668668
body.ExternalBitbucketSecret = &p.Secret.Value
669669
}
670670
}
671671
}
672672
if p, ok := e["discord"]; ok {
673673
if body.ExternalDiscordEnabled = &p.Enabled; *body.ExternalDiscordEnabled {
674674
body.ExternalDiscordClientId = &p.ClientId
675-
if len(p.Secret.Value) > 0 {
675+
if len(p.Secret.SHA256) > 0 {
676676
body.ExternalDiscordSecret = &p.Secret.Value
677677
}
678678
}
679679
}
680680
if p, ok := e["facebook"]; ok {
681681
if body.ExternalFacebookEnabled = &p.Enabled; *body.ExternalFacebookEnabled {
682682
body.ExternalFacebookClientId = &p.ClientId
683-
if len(p.Secret.Value) > 0 {
683+
if len(p.Secret.SHA256) > 0 {
684684
body.ExternalFacebookSecret = &p.Secret.Value
685685
}
686686
}
687687
}
688688
if p, ok := e["figma"]; ok {
689689
if body.ExternalFigmaEnabled = &p.Enabled; *body.ExternalFigmaEnabled {
690690
body.ExternalFigmaClientId = &p.ClientId
691-
if len(p.Secret.Value) > 0 {
691+
if len(p.Secret.SHA256) > 0 {
692692
body.ExternalFigmaSecret = &p.Secret.Value
693693
}
694694
}
695695
}
696696
if p, ok := e["github"]; ok {
697697
if body.ExternalGithubEnabled = &p.Enabled; *body.ExternalGithubEnabled {
698698
body.ExternalGithubClientId = &p.ClientId
699-
if len(p.Secret.Value) > 0 {
699+
if len(p.Secret.SHA256) > 0 {
700700
body.ExternalGithubSecret = &p.Secret.Value
701701
}
702702
}
703703
}
704704
if p, ok := e["gitlab"]; ok {
705705
if body.ExternalGitlabEnabled = &p.Enabled; *body.ExternalGitlabEnabled {
706706
body.ExternalGitlabClientId = &p.ClientId
707-
if len(p.Secret.Value) > 0 {
707+
if len(p.Secret.SHA256) > 0 {
708708
body.ExternalGitlabSecret = &p.Secret.Value
709709
}
710710
body.ExternalGitlabUrl = &p.Url
@@ -713,7 +713,7 @@ func (e external) toAuthConfigBody(body *v1API.UpdateAuthConfigBody) {
713713
if p, ok := e["google"]; ok {
714714
if body.ExternalGoogleEnabled = &p.Enabled; *body.ExternalGoogleEnabled {
715715
body.ExternalGoogleClientId = &p.ClientId
716-
if len(p.Secret.Value) > 0 {
716+
if len(p.Secret.SHA256) > 0 {
717717
body.ExternalGoogleSecret = &p.Secret.Value
718718
}
719719
body.ExternalGoogleSkipNonceCheck = &p.SkipNonceCheck
@@ -722,15 +722,15 @@ func (e external) toAuthConfigBody(body *v1API.UpdateAuthConfigBody) {
722722
if p, ok := e["kakao"]; ok {
723723
if body.ExternalKakaoEnabled = &p.Enabled; *body.ExternalKakaoEnabled {
724724
body.ExternalKakaoClientId = &p.ClientId
725-
if len(p.Secret.Value) > 0 {
725+
if len(p.Secret.SHA256) > 0 {
726726
body.ExternalKakaoSecret = &p.Secret.Value
727727
}
728728
}
729729
}
730730
if p, ok := e["keycloak"]; ok {
731731
if body.ExternalKeycloakEnabled = &p.Enabled; *body.ExternalKeycloakEnabled {
732732
body.ExternalKeycloakClientId = &p.ClientId
733-
if len(p.Secret.Value) > 0 {
733+
if len(p.Secret.SHA256) > 0 {
734734
body.ExternalKeycloakSecret = &p.Secret.Value
735735
}
736736
body.ExternalKeycloakUrl = &p.Url
@@ -739,55 +739,55 @@ func (e external) toAuthConfigBody(body *v1API.UpdateAuthConfigBody) {
739739
if p, ok := e["linkedin_oidc"]; ok {
740740
if body.ExternalLinkedinOidcEnabled = &p.Enabled; *body.ExternalLinkedinOidcEnabled {
741741
body.ExternalLinkedinOidcClientId = &p.ClientId
742-
if len(p.Secret.Value) > 0 {
742+
if len(p.Secret.SHA256) > 0 {
743743
body.ExternalLinkedinOidcSecret = &p.Secret.Value
744744
}
745745
}
746746
}
747747
if p, ok := e["notion"]; ok {
748748
if body.ExternalNotionEnabled = &p.Enabled; *body.ExternalNotionEnabled {
749749
body.ExternalNotionClientId = &p.ClientId
750-
if len(p.Secret.Value) > 0 {
750+
if len(p.Secret.SHA256) > 0 {
751751
body.ExternalNotionSecret = &p.Secret.Value
752752
}
753753
}
754754
}
755755
if p, ok := e["slack_oidc"]; ok {
756756
if body.ExternalSlackOidcEnabled = &p.Enabled; *body.ExternalSlackOidcEnabled {
757757
body.ExternalSlackOidcClientId = &p.ClientId
758-
if len(p.Secret.Value) > 0 {
758+
if len(p.Secret.SHA256) > 0 {
759759
body.ExternalSlackOidcSecret = &p.Secret.Value
760760
}
761761
}
762762
}
763763
if p, ok := e["spotify"]; ok {
764764
if body.ExternalSpotifyEnabled = &p.Enabled; *body.ExternalSpotifyEnabled {
765765
body.ExternalSpotifyClientId = &p.ClientId
766-
if len(p.Secret.Value) > 0 {
766+
if len(p.Secret.SHA256) > 0 {
767767
body.ExternalSpotifySecret = &p.Secret.Value
768768
}
769769
}
770770
}
771771
if p, ok := e["twitch"]; ok {
772772
if body.ExternalTwitchEnabled = &p.Enabled; *body.ExternalTwitchEnabled {
773773
body.ExternalTwitchClientId = &p.ClientId
774-
if len(p.Secret.Value) > 0 {
774+
if len(p.Secret.SHA256) > 0 {
775775
body.ExternalTwitchSecret = &p.Secret.Value
776776
}
777777
}
778778
}
779779
if p, ok := e["twitter"]; ok {
780780
if body.ExternalTwitterEnabled = &p.Enabled; *body.ExternalTwitterEnabled {
781781
body.ExternalTwitterClientId = &p.ClientId
782-
if len(p.Secret.Value) > 0 {
782+
if len(p.Secret.SHA256) > 0 {
783783
body.ExternalTwitterSecret = &p.Secret.Value
784784
}
785785
}
786786
}
787787
if p, ok := e["workos"]; ok {
788788
if body.ExternalWorkosEnabled = &p.Enabled; *body.ExternalWorkosEnabled {
789789
body.ExternalWorkosClientId = &p.ClientId
790-
if len(p.Secret.Value) > 0 {
790+
if len(p.Secret.SHA256) > 0 {
791791
body.ExternalWorkosSecret = &p.Secret.Value
792792
}
793793
body.ExternalWorkosUrl = &p.Url
@@ -796,7 +796,7 @@ func (e external) toAuthConfigBody(body *v1API.UpdateAuthConfigBody) {
796796
if p, ok := e["zoom"]; ok {
797797
if body.ExternalZoomEnabled = &p.Enabled; *body.ExternalZoomEnabled {
798798
body.ExternalZoomClientId = &p.ClientId
799-
if len(p.Secret.Value) > 0 {
799+
if len(p.Secret.SHA256) > 0 {
800800
body.ExternalZoomSecret = &p.Secret.Value
801801
}
802802
}

‎pkg/config/config.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -433,6 +433,7 @@ func (c *config) loadFromReader(v *viper.Viper, r io.Reader) error {
433433
if err := v.UnmarshalExact(c, func(dc *mapstructure.DecoderConfig) {
434434
dc.TagName = "toml"
435435
dc.Squash = true
436+
dc.ZeroFields = true
436437
dc.DecodeHook = c.newDecodeHook(LoadEnvHook)
437438
}); err != nil {
438439
return errors.Errorf("failed to parse config: %w", err)

‎pkg/config/secret.go‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -64,17 +64,16 @@ func DecryptSecretHookFunc(hashKey string) mapstructure.DecodeHookFunc {
6464
if t != reflect.TypeOf(result) {
6565
return data, nil
6666
}
67-
ciphertext := data.(string)
68-
// Skip hashing unloaded env
69-
if matches := envPattern.FindStringSubmatch(ciphertext); len(matches) > 1 {
70-
return result, nil
71-
}
7267
var err error
7368
privKey := os.Getenv("DOTENV_PRIVATE_KEY")
7469
for _, k := range strings.Split(privKey, ",") {
75-
result.Value, err = decrypt(k, ciphertext)
76-
if err == nil && len(result.Value) > 0 {
77-
result.SHA256 = sha256Hmac(hashKey, result.Value)
70+
// Use the first private key that successfully decrypts the secret
71+
if result.Value, err = decrypt(k, data.(string)); err == nil {
72+
// Unloaded env() references may be returned verbatim.
73+
// Don't hash those values as they are meaningless.
74+
if !envPattern.MatchString(result.Value) {
75+
result.SHA256 = sha256Hmac(hashKey, result.Value)
76+
}
7877
break
7978
}
8079
}

0 commit comments

Comments
 (0)