getsops / getsops/sops

Encrypting yaml files with multiple docs including comments with unicode characters causes first key's first character to be removed

Open
#742 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
23.1k
Forks
1.1k
Avg merge
1d 11h
Merged PRs (30d)
9

Description

If you are encrypting multiple yaml documents, and you include a comment in any document except the first document, the first character of some of the subsequent documents will be removed. A couple of examples:

Original:

hello: world
---
hello: world
# ✅
---
hello: world

Encrypted and decrypted:

hello: world
---
ello: world
# ✅
---
hello: world

Original:

hello: world
---
hello: world
---
hello: world
# ✅

Encrypted and decrypted:

hello: world
---
ello: world
---
ello: world
# ✅

Tested on versions 3.5.0 and 3.6.1, both reproduce this issue, and I'm using AWS KMS to encrypt/decrypt.

Let me know if you need any more info.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the reported encrypt/decrypt round trips with the two multi-document YAML examples and AWS KMS. Compare each document before and after processing, especially documents following comments containing the shown Unicode character. Done means every document retains its original first key character while the round trip continues to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.