According to the documentation <a href="https://github.com/jmazzi/crypt_keeper/blob/ma

I think the fix in <a class="issue-link js-issue-link" data-error-text="Failed to load

AES New Encryptor doesn't handle empty string about crypt_keeper HOT 2 CLOSED

jmazzi commented on August 16, 2024

AES New Encryptor doesn't handle empty string

from crypt_keeper.

Comments (2)

jesperronn commented on August 16, 2024

👍 for the fix. It bites me currently and prevents me from upgrading Rails

from crypt_keeper.

danielricecodes commented on August 16, 2024

I think the fix in #110 might cause issues using search_by_plaintext. If a blank string leaks into my table, I can no longer use search_by_plaintext. If I delete any records with a blank string - I can scan my table again.

I'm not sure if this is a separate issue or not b/c PR #110 hasn't been merged yet.

[6] pry(main)> Lessee.search_by_plaintext(:ssn, '123').any?
  Lessee Exists (353.1ms)  SELECT  1 AS one FROM "lessees" WHERE pgp_sym_decrypt([FILTERED]) LIMIT $1  [["LIMIT", 1]]
=> false
[7] pry(main)> ssn.update_attributes(ssn: '')
   (0.2ms)  BEGIN
  SQL (0.4ms)  UPDATE "lessees" SET "updated_at" = $1, "ssn" = $2 WHERE "lessees"."id" = $3  [["updated_at", "2018-01-17 21:07:29.278633"], ["ssn", ""], ["id", 1111]]
   (1.9ms)  COMMIT
=> true
[8] pry(main)> Lessee.search_by_plaintext(:ssn, '123').any?
  Lessee Exists (120.4ms)  SELECT  1 AS one FROM "lessees" WHERE pgp_sym_decrypt([FILTERED]) LIMIT $1  [["LIMIT", 1]]
ActiveRecord::StatementInvalid: PG::ExternalRoutineInvocationException: ERROR:  Wrong key or corrupt data
: SELECT  1 AS one FROM "lessees" WHERE ((pgp_sym_decrypt(cast("ssn" AS bytea), '[MANUALLY FILTERED') = '123')) LIMIT $1
from /Users/danielrice/.rvm/gems/ruby-2.4.2/gems/rack-mini-profiler-0.10.5/lib/patches/db/pg.rb:90:in `async_exec'

As a workaround I can add an extra scope in my code to filter out blank values.

Lessee.where.not(ssn: '').search_by_plaintext(:ssn, '123').any?
  Lessee Exists (339.6ms)  SELECT  1 AS one FROM "lessees" WHERE ("lessees"."ssn" != $1) AND pgp_sym_decrypt([FILTERED]) LIMIT $2  [["ssn", ""], ["LIMIT", 1]]
=> false

from crypt_keeper.

Recommend Projects