aws / aws/aws-dynamodb-encryption-java
NPE if using CachingMostRecentProvider to decrypt records without "amzn-ddb-meta-id"
- 主要语言
- Java
- 星标
- 141
- 派生
- 74
- PR 合并指标
- 30 天内没有已合并 PR
描述
### Problem:
If a user attempts to use a CachingMostRecentProvider to decrypt a record that *does* contain a mat-desc, but that mat-desc does not contain the key value "amzn-ddb-meta-id," they get an NPE. This can happen if a user tries to encrypt with another one of our providers then decrypt with the CachingMostRecentProvider.
### Solution:
Instead, users should get a more friendly error that decryption was unable to succeed.
### Out of scope:
The CachingMostRecentProvider is not intended to interoperate with other providers.
[//]: # (NOTE: If you believe this might be a security issue, please email aws-security@amazon.com instead of creating a GitHub issue. For more details, see the AWS Vulnerability Reporting Guide: https://aws.amazon.com/security/vulnerability-reporting/ )
贡献指南
调研方向
从 issue 中描述的 CachingMostRecentProvider 解密路径开始,跟踪不包含 "amzn-ddb-meta-id" 的 mat-desc 是如何处理的。使用由另一个 Provider 加密的记录重现该情况,然后验证解密失败时会返回易于理解的错误,而不是产生 NPE。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- java
- 领域
- security
- Issue 类型
- 缺陷
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 活跃度
- 停滞
- 描述清晰度
- 基本清楚
- 新手友好度
- 45/100