diff options
| author | Vipul A M <vipulnsward@gmail.com> | 2016-07-09 04:03:43 -0700 |
|---|---|---|
| committer | Vipul A M <vipulnsward@gmail.com> | 2016-09-01 02:53:48 +0530 |
| commit | ae32b69ab9647f4072d6852c4d4d1f2a939360c1 (patch) | |
| tree | 16e711ce8df8e449a5281fd75a5d73abfc56a305 /activesupport | |
| parent | fd2446cd8156f288598cdb47172cfe31ec24c1ee (diff) | |
| download | rails-ae32b69ab9647f4072d6852c4d4d1f2a939360c1.tar.gz rails-ae32b69ab9647f4072d6852c4d4d1f2a939360c1.tar.bz2 rails-ae32b69ab9647f4072d6852c4d4d1f2a939360c1.zip | |
Follow up of #25602
Since keys are truncated, ruby 2.4 doesn't accept keys greater than their lenghts.
keys of same value but different lenght and greater than key size of cipher, produce the same results
as reproduced at https://gist.github.com/rhenium/b81355fe816dcfae459cc5eadfc4f6f9
Since our default cipher is 'aes-256-cbc', key length for which is 32 bytes, limit the length of key being passed to Encryptor to 32 bytes.
This continues to support backwards compat with any existing signed data, already encrupted and signed with 32+ byte keys.
Also fixes the passing of this value in multiple tests.
Diffstat (limited to 'activesupport')
| -rw-r--r-- | activesupport/test/message_encryptor_test.rb | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/activesupport/test/message_encryptor_test.rb b/activesupport/test/message_encryptor_test.rb index fb0b1e377d..fc17fdf3ee 100644 --- a/activesupport/test/message_encryptor_test.rb +++ b/activesupport/test/message_encryptor_test.rb @@ -48,6 +48,16 @@ class MessageEncryptorTest < ActiveSupport::TestCase assert_equal @data, @encryptor.decrypt_and_verify(message) end + def test_backwards_compat_for_64_bytes_key + # 64 bit key + secret = ["3942b1bf81e622559ed509e3ff274a780784fe9e75b065866bd270438c74da822219de3156473cc27df1fd590e4baf68c95eeb537b6e4d4c5a10f41635b5597e"].pack('H*') + # Encryptor with 32 bit key, 64 bit secret for verifier + encryptor = ActiveSupport::MessageEncryptor.new(secret[0..31], secret) + # Message generated with 64 bit key + message = "eHdGeExnZEwvMSt3U3dKaFl1WFo0TjVvYzA0eGpjbm5WSkt5MXlsNzhpZ0ZnbWhBWFlQZTRwaXE1bVJCS2oxMDZhYVp2dVN3V0lNZUlWQ3c2eVhQbnhnVjFmeVVubmhRKzF3WnZyWHVNMDg9LS1HSisyakJVSFlPb05ISzRMaXRzcFdBPT0=--831a1d54a3cda8a0658dc668a03dedcbce13b5ca" + assert_equal 'data', encryptor.decrypt_and_verify(message)[:some] + end + def test_alternative_serialization_method prev = ActiveSupport.use_standard_json_time_format ActiveSupport.use_standard_json_time_format = true |