aws / aws/aws-dynamodb-encryption-java

NPE if using CachingMostRecentProvider to decrypt records without "amzn-ddb-meta-id"

Aperta
#144 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Java
Stelle
141
Fork
74
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

### Problem:

If a user attempts to use a CachingMostRecentProvider to decrypt a record that *does* contain a mat-desc, but that mat-desc does not contain the key value "amzn-ddb-meta-id," they get an NPE. This can happen if a user tries to encrypt with another one of our providers then decrypt with the CachingMostRecentProvider.

### Solution:

Instead, users should get a more friendly error that decryption was unable to succeed.

### Out of scope:

The CachingMostRecentProvider is not intended to interoperate with other providers.

[//]: # (NOTE: If you believe this might be a security issue, please email aws-security@amazon.com instead of creating a GitHub issue. For more details, see the AWS Vulnerability Reporting Guide: https://aws.amazon.com/security/vulnerability-reporting/ )

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Start at the CachingMostRecentProvider decryption path described in the issue and trace how a mat-desc without "amzn-ddb-meta-id" is handled. Reproduce the case using a record encrypted by another provider, then verify that decryption fails with a friendly error rather than an NPE.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
java
Ambito
security
Tipo di issue
Bug
Difficoltà
2/5
Tempo stimato
1-3 ore
Stato di attività
Ferma
Chiarezza
Abbastanza chiara
Idoneità per principianti
45/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.