aws / aws/aws-dynamodb-encryption-python

Upgrading "Do Nothing" model to one with a single action fails to decrypt old items

未关闭
#177 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
bug
主要语言
Python
星标
95
派生
57
PR 合并指标
30 天内没有已合并 PR

描述

### Problem:

According to our documentation it should always be possible to add new attributes to our model without issue: https://docs.aws.amazon.com/dynamodb-encryption-client/latest/devguide/data-model.html#add-attribute

However, if you start with data encrypted using
```
actions = AttributeActions(
default_action=CryptoAction.DO_NOTHING
)
```

And update to using
```
actions = AttributeActions(
default_action=CryptoAction.DO_NOTHING, attribute_actions={"someNewField": CryptoAction.ENCRYPT_AND_SIGN}
)
```

You run into issues. This is because data under the first model doesn't have a material description or signature written with it. Once the model is updated to include an action other than `DO_NOTHING`, it always expects there to be a material description and signature, *even if the record it's attempting to decrypt doesn't include `someNewField` yet*.

### Solution:

We should probably update the logic here to also pass through if the item under decrypt specifically doesn't have attributes where encryption or signing is needed, even if the attributeActions includes an encrypt or sign action for a non-present field.

https://github.com/aws/aws-dynamodb-encryption-python/blob/25c7c3d80bfbe0deb661b4beb86f61b8b2f8545e/src/dynamodb_encryption_sdk/encrypted/item.py#L176-L178

https://github.com/aws/aws-dynamodb-encryption-python/blob/25c7c3d80bfbe0deb661b4beb86f61b8b2f8545e/src/dynamodb_encryption_sdk/structures.py#L137-L148

贡献指南

打开贡献指南

调研方向

从 src/dynamodb_encryption_sdk/encrypted/item.py 的第 176-178 行附近以及 src/dynamodb_encryption_sdk/structures.py 的第 137-148 行附近开始。重现从仅使用 DO_NOTHING 的 AttributeActions 模型转换为针对 someNewField 添加 ENCRYPT_AND_SIGN 的模型的过程,然后跟踪对不包含该字段的旧项进行解密的过程。当在更新后的模型下,缺少要求加密或签名的属性的旧项仍然可以被解密时,即表示完成。

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
security
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。