From faa54cc14786eda1dbe1071e0cc495220ac11599 Mon Sep 17 00:00:00 2001 From: Mikko Koli Date: Wed, 21 Mar 2018 15:43:19 +0200 Subject: [PATCH] Allow empty plaintext for transit decryption. Fixes gh-223. Original pull request: gh-225. --- .../vault/core/VaultTransitTemplate.java | 9 ++++- .../VaultTransitTemplateIntegrationTests.java | 36 +++++++++++++++++++ 2 files changed, 44 insertions(+), 1 deletion(-) diff --git a/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java b/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java index ed4e043f..2f894cf5 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java @@ -404,10 +404,12 @@ public class VaultTransitTemplate implements VaultTransitOperations { encrypted = new VaultDecryptionResult(new VaultException( data.get("error"))); } - else { + else if (StringUtils.hasText(data.get("plaintext"))) { encrypted = new VaultDecryptionResult(toPlaintext( Base64Utils.decodeFromString(data.get("plaintext")), ciphertext.getContext())); + } else { + encrypted = new VaultDecryptionResult(toPlaintext("",ciphertext.getContext())); } } else { @@ -431,6 +433,11 @@ public class VaultTransitTemplate implements VaultTransitOperations { .of(plaintext); } + private static Plaintext toPlaintext(String plaintext, VaultTransitContext context) { + return context != null ? Plaintext.of(plaintext).with(context) : Plaintext + .of(plaintext); + } + @SuppressWarnings("unchecked") private static List> getBatchData(VaultResponse vaultResponse) { return (List>) vaultResponse.getData().get("batch_results"); diff --git a/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java b/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java index e7110ee2..24ddbbdb 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java @@ -503,4 +503,40 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport assertThat(decrypted.get(1).isSuccessful()).isEqualTo(false); assertThat(decrypted.get(1).getCause()).isInstanceOf(VaultException.class); } + + @Test + public void shouldBatchDecryptEmptyPlaintext() { + assumeTrue(vaultVersion.isGreaterThanOrEqualTo(BATCH_INTRODUCED_IN_VERSION)); + + transitOperations.createKey("mykey"); + + Ciphertext empty = transitOperations.encrypt("mykey", Plaintext.of("")); + + List decrypted = transitOperations.decrypt("mykey", + Arrays.asList(empty)); + + assertThat(decrypted.get(0).getAsString()).isEqualTo(""); + } + + @Test + public void shouldBatchDecryptEmpltyPlaintextWithContext() { + + assumeTrue(vaultVersion.isGreaterThanOrEqualTo(BATCH_INTRODUCED_IN_VERSION)); + + VaultTransitKeyCreationRequest request = VaultTransitKeyCreationRequest.builder() // + .derived(true) // + .build(); + + transitOperations.createKey("mykey", request); + + Plaintext empty = Plaintext.of("").with( + VaultTransitContext.builder().context("oneContext".getBytes()).build()); + + List encrypted = transitOperations.encrypt("mykey", + Arrays.asList(empty)); + List decrypted = transitOperations.decrypt("mykey", + Arrays.asList(encrypted.get(0).get())); + + assertThat(decrypted.get(0).get()).isEqualTo(empty); + } }