spring-projects / spring-projects/spring-vault

CertificateBundle.of uses private key value instead of type, which causes exception throwing when trying to access private key

Open Beginner friendly
#1,047 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
306
Forks
202
PR merge metrics
No merged PRs in 30d

Description

CertificateBundle.of is a thin wrapper around the CertificateBundle constructor, but calls it with wrong arguments, supplying privateKey as both 5th and 6th arguments to the constructor:
https://github.com/spring-projects/spring-vault/blob/b8fce1d71b15eaec7647f92fd2c0e1101f67801d/spring-vault-core/src/main/java/org/springframework/vault/support/CertificateBundle.java#L91-L99

The 6th argument of CertificateBundle is expected to be a key type name (such as "rsa" or "ec"), which initializes this.privateKeyType:
https://github.com/spring-projects/spring-vault/blob/b8fce1d71b15eaec7647f92fd2c0e1101f67801d/spring-vault-core/src/main/java/org/springframework/vault/support/CertificateBundle.java#L70-L79

As a consequence, calls to getPrivateKey() throw IllegalArgumentException because this.privateKeyType is neither "rsa" nor "ec" but a key value instead:
https://github.com/spring-projects/spring-vault/blob/b8fce1d71b15eaec7647f92fd2c0e1101f67801d/spring-vault-core/src/main/java/org/springframework/vault/support/CertificateBundle.java#L308-L315

I guess this issue could be fixed by replacing the second occurrence of privateKey with null in the constructor call at line 98, but I am not a java programmer, so I will leave the fix to a more competent person.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in spring-vault-core/src/main/java/org/springframework/vault/support/CertificateBundle.java at CertificateBundle.of, then inspect the constructor and getPrivateKey(). Correct the constructor argument so the private key type is initialized from the intended value, and verify that getPrivateKey() no longer throws for RSA or EC keys.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
88/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.