aws / aws/aws-dynamodb-encryption-java

NPE if using CachingMostRecentProvider to decrypt records without "amzn-ddb-meta-id"

未关闭
#144 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Java
星标
141
派生
74
PR 合并指标
30 天内没有已合并 PR

描述

### Problem:

If a user attempts to use a CachingMostRecentProvider to decrypt a record that *does* contain a mat-desc, but that mat-desc does not contain the key value "amzn-ddb-meta-id," they get an NPE. This can happen if a user tries to encrypt with another one of our providers then decrypt with the CachingMostRecentProvider.

### Solution:

Instead, users should get a more friendly error that decryption was unable to succeed.

### Out of scope:

The CachingMostRecentProvider is not intended to interoperate with other providers.

[//]: # (NOTE: If you believe this might be a security issue, please email aws-security@amazon.com instead of creating a GitHub issue. For more details, see the AWS Vulnerability Reporting Guide: https://aws.amazon.com/security/vulnerability-reporting/ )

贡献指南

打开贡献指南

调研方向

从 issue 中描述的 CachingMostRecentProvider 解密路径开始,跟踪不包含 "amzn-ddb-meta-id" 的 mat-desc 是如何处理的。使用由另一个 Provider 加密的记录重现该情况,然后验证解密失败时会返回易于理解的错误,而不是产生 NPE。

由索引模型根据 Issue 内容生成。

评估

技术栈
java
领域
security
Issue 类型
缺陷
难度
2/5
预计耗时
1-3 小时
活跃度
停滞
描述清晰度
基本清楚
新手友好度
45/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。