8000 bug #58419 [FrameworkBundle] Never hash the empty decryption key to c… · symfony/symfony@40d0089 · GitHub
[go: up one dir, main page]
Skip to content

Commit 40d0089

Browse files
nicolas-grekasnicolas-grekas
committed
bug #58419 [FrameworkBundle] Never hash the empty decryption key to compute kernel.secret (nicolas-grekas)
This PR was merged into the 7.2 branch. Discussion ---------- [FrameworkBundle] Never hash the empty decryption key to compute `kernel.secret` | Q | A | ------------- | --- | Branch? | 7.2 | Bug fix? | yes | New feature? | no | Deprecations? | no | Issues | - | License | MIT As spotted by `@javiereguiluz` in symfony/demo#1529 (comment) Commits ------- b6d6bc1 [FrameworkBundle] Never hash the empty decryption key to compute kernel.secret
2 parents 434e901 + b6d6bc1 commit 40d0089

File tree

2 files changed

+17
-3
lines changed

2 files changed

+17
-3
lines changed

‎src/Symfony/Bundle/FrameworkBundle/Secrets/SodiumVault.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ public function reveal(string $name): ?string
114114

115115
$this->loadKeys();
116116

117-
if ('' === $this->decryptionKey) {
117+
if ('' === $this->decryptionKey = (string) $this->decryptionKey) {
118118
$this->lastMessage = \sprintf('Secret "%s" cannot be revealed as no decryption key was found in "%s".', $name, $this->getPrettyPath(\dirname($this->pathPrefix).\DIRECTORY_SEPARATOR));
119119

120120
return null;
@@ -181,8 +181,8 @@ public function loadEnvVars(): array
181181
}
182182

183183
if ($this->derivedSecretEnvVar && !\array_key_exists($this->derivedSecretEnvVar, $envs)) {
184-
$decryptionKey = $this->decryptionKey;
185-
$envs[$this->derivedSecretEnvVar] = LazyString::fromCallable(static fn () => base64_encode(hash('sha256', $decryptionKey, true)));
184+
$k = $this->decryptionKey;
185+
$envs[$this->derivedSecretEnvVar] = LazyString::fromCallable(static fn () => '' !== ($k = (string) $k) ? base64_encode(hash('sha256', $k, true)) : '');
186186
}
187187

188188
return $envs;

‎src/Symfony/Bundle/FrameworkBundle/Tests/Secrets/SodiumVaultTest.php

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
use PHPUnit\Framework\TestCase;
1515
use Symfony\Bundle\FrameworkBundle\Secrets\SodiumVault;
1616
use Symfony\Component\Filesystem\Filesystem;
17+
use Symfony\Component\String\LazyString;
1718

1819
/**
1920
* @requires extension sodium
@@ -84,4 +85,17 @@ public function testDerivedSecretEnvVar()
8485

8586
$this->assertSame(['FOO', 'MY_SECRET'], array_keys($vault->loadEnvVars()));
8687
}
88+
89+
public function testEmptySecretEnvVar()
90+
{
91+
$vault = new SodiumVault($this->secretsDir, '', 'MY_SECRET');
92+
$envVars = $vault->loadEnvVars();
93+
$envVars['MY_SECRET'] = (string) $envVars['MY_SECRET'];
94+
$this->assertSame(['MY_SECRET' => ''], $envVars);
95+
96+
$vault = new SodiumVault($this->secretsDir, LazyString::fromCallable(fn () => ''), 'MY_SECRET');
97+
$envVars = $vault->loadEnvVars();
98+
$envVars['MY_SECRET'] = (string) $envVars['MY_SECRET'];
99+
$this->assertSame(['MY_SECRET' => ''], $envVars);
100+
}
87101
}

0 commit comments

Comments
 (0)
0