spring-projects / spring-projects/spring-vault
CertificateBundle.of uses private key value instead of type, which causes exception throwing when trying to access private key
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 306
- Forks
- 202
- PR merge metrics
- No merged PRs in 30d
Description
CertificateBundle.of is a thin wrapper around the CertificateBundle constructor, but calls it with wrong arguments, supplying privateKey as both 5th and 6th arguments to the constructor:
https://github.com/spring-projects/spring-vault/blob/b8fce1d71b15eaec7647f92fd2c0e1101f67801d/spring-vault-core/src/main/java/org/springframework/vault/support/CertificateBundle.java#L91-L99
The 6th argument of CertificateBundle is expected to be a key type name (such as "rsa" or "ec"), which initializes this.privateKeyType:
https://github.com/spring-projects/spring-vault/blob/b8fce1d71b15eaec7647f92fd2c0e1101f67801d/spring-vault-core/src/main/java/org/springframework/vault/support/CertificateBundle.java#L70-L79
As a consequence, calls to getPrivateKey() throw IllegalArgumentException because this.privateKeyType is neither "rsa" nor "ec" but a key value instead:
https://github.com/spring-projects/spring-vault/blob/b8fce1d71b15eaec7647f92fd2c0e1101f67801d/spring-vault-core/src/main/java/org/springframework/vault/support/CertificateBundle.java#L308-L315
I guess this issue could be fixed by replacing the second occurrence of privateKey with null in the constructor call at line 98, but I am not a java programmer, so I will leave the fix to a more competent person.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in spring-vault-core/src/main/java/org/springframework/vault/support/CertificateBundle.java at CertificateBundle.of, then inspect the constructor and getPrivateKey(). Correct the constructor argument so the private key type is initialized from the intended value, and verify that getPrivateKey() no longer throws for RSA or EC keys.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 88/100