From 9e35642edc215b7623fadb131fc8213209250411 Mon Sep 17 00:00:00 2001 From: spring-builds Date: Fri, 10 Jan 2025 00:10:17 +0000 Subject: [PATCH 1/6] Update SNAPSHOT to 4.1.5 --- docs/pom.xml | 2 +- pom.xml | 6 +++--- spring-cloud-config-client-tls-tests/pom.xml | 2 +- spring-cloud-config-client/pom.xml | 2 +- spring-cloud-config-dependencies/pom.xml | 4 ++-- spring-cloud-config-monitor/pom.xml | 4 ++-- spring-cloud-config-sample/pom.xml | 2 +- spring-cloud-config-server/pom.xml | 2 +- spring-cloud-starter-config/pom.xml | 4 ++-- 9 files changed, 14 insertions(+), 14 deletions(-) diff --git a/docs/pom.xml b/docs/pom.xml index 71916461..b8a3fa50 100644 --- a/docs/pom.xml +++ b/docs/pom.xml @@ -8,7 +8,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.5 .. jar diff --git a/pom.xml b/pom.xml index ffffcc6b..5a120e04 100644 --- a/pom.xml +++ b/pom.xml @@ -5,7 +5,7 @@ 4.0.0 org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.5 pom Spring Cloud Config Spring Cloud Config @@ -13,7 +13,7 @@ org.springframework.cloud spring-cloud-build - 4.1.5-SNAPSHOT + 4.1.5 @@ -27,7 +27,7 @@ config - 4.1.6-SNAPSHOT + 4.1.5 2.18.41 v1-rev20201112-1.30.10 2.31.0 diff --git a/spring-cloud-config-client-tls-tests/pom.xml b/spring-cloud-config-client-tls-tests/pom.xml index 664d162d..15b95446 100644 --- a/spring-cloud-config-client-tls-tests/pom.xml +++ b/spring-cloud-config-client-tls-tests/pom.xml @@ -9,7 +9,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.5 .. diff --git a/spring-cloud-config-client/pom.xml b/spring-cloud-config-client/pom.xml index eca1c03a..620be760 100644 --- a/spring-cloud-config-client/pom.xml +++ b/spring-cloud-config-client/pom.xml @@ -10,7 +10,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.5 .. diff --git a/spring-cloud-config-dependencies/pom.xml b/spring-cloud-config-dependencies/pom.xml index 6be02b96..27a3716a 100644 --- a/spring-cloud-config-dependencies/pom.xml +++ b/spring-cloud-config-dependencies/pom.xml @@ -6,11 +6,11 @@ spring-cloud-dependencies-parent org.springframework.cloud - 4.1.5-SNAPSHOT + 4.1.5 spring-cloud-config-dependencies - 4.1.5-SNAPSHOT + 4.1.5 pom spring-cloud-config-dependencies Spring Cloud Config Dependencies diff --git a/spring-cloud-config-monitor/pom.xml b/spring-cloud-config-monitor/pom.xml index 3e741368..28f053a6 100644 --- a/spring-cloud-config-monitor/pom.xml +++ b/spring-cloud-config-monitor/pom.xml @@ -6,7 +6,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.5 .. spring-cloud-config-monitor @@ -14,7 +14,7 @@ Spring Cloud Config Monitor ${basedir}/../.. - 4.1.4-SNAPSHOT + 4.1.3 diff --git a/spring-cloud-config-sample/pom.xml b/spring-cloud-config-sample/pom.xml index f7318702..6dcdbc8a 100644 --- a/spring-cloud-config-sample/pom.xml +++ b/spring-cloud-config-sample/pom.xml @@ -13,7 +13,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.5 .. diff --git a/spring-cloud-config-server/pom.xml b/spring-cloud-config-server/pom.xml index b2f333c5..d98760b1 100644 --- a/spring-cloud-config-server/pom.xml +++ b/spring-cloud-config-server/pom.xml @@ -13,7 +13,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.5 .. diff --git a/spring-cloud-starter-config/pom.xml b/spring-cloud-starter-config/pom.xml index e13eceb3..99074c9b 100644 --- a/spring-cloud-starter-config/pom.xml +++ b/spring-cloud-starter-config/pom.xml @@ -6,10 +6,10 @@ org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.5 spring-cloud-starter-config - 4.1.5-SNAPSHOT + 4.1.5 spring-cloud-starter-config Spring Cloud Starter https://projects.spring.io/spring-cloud From 438475f07261804a58dbe681c7425e5d2bb10c61 Mon Sep 17 00:00:00 2001 From: spring-builds Date: Fri, 10 Jan 2025 00:11:18 +0000 Subject: [PATCH 2/6] Going back to snapshots --- docs/pom.xml | 2 +- pom.xml | 6 +++--- spring-cloud-config-client-tls-tests/pom.xml | 2 +- spring-cloud-config-client/pom.xml | 2 +- spring-cloud-config-dependencies/pom.xml | 4 ++-- spring-cloud-config-monitor/pom.xml | 4 ++-- spring-cloud-config-sample/pom.xml | 2 +- spring-cloud-config-server/pom.xml | 2 +- spring-cloud-starter-config/pom.xml | 4 ++-- 9 files changed, 14 insertions(+), 14 deletions(-) diff --git a/docs/pom.xml b/docs/pom.xml index b8a3fa50..71916461 100644 --- a/docs/pom.xml +++ b/docs/pom.xml @@ -8,7 +8,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5 + 4.1.5-SNAPSHOT .. jar diff --git a/pom.xml b/pom.xml index 5a120e04..ffffcc6b 100644 --- a/pom.xml +++ b/pom.xml @@ -5,7 +5,7 @@ 4.0.0 org.springframework.cloud spring-cloud-config - 4.1.5 + 4.1.5-SNAPSHOT pom Spring Cloud Config Spring Cloud Config @@ -13,7 +13,7 @@ org.springframework.cloud spring-cloud-build - 4.1.5 + 4.1.5-SNAPSHOT @@ -27,7 +27,7 @@ config - 4.1.5 + 4.1.6-SNAPSHOT 2.18.41 v1-rev20201112-1.30.10 2.31.0 diff --git a/spring-cloud-config-client-tls-tests/pom.xml b/spring-cloud-config-client-tls-tests/pom.xml index 15b95446..664d162d 100644 --- a/spring-cloud-config-client-tls-tests/pom.xml +++ b/spring-cloud-config-client-tls-tests/pom.xml @@ -9,7 +9,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5 + 4.1.5-SNAPSHOT .. diff --git a/spring-cloud-config-client/pom.xml b/spring-cloud-config-client/pom.xml index 620be760..eca1c03a 100644 --- a/spring-cloud-config-client/pom.xml +++ b/spring-cloud-config-client/pom.xml @@ -10,7 +10,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5 + 4.1.5-SNAPSHOT .. diff --git a/spring-cloud-config-dependencies/pom.xml b/spring-cloud-config-dependencies/pom.xml index 27a3716a..6be02b96 100644 --- a/spring-cloud-config-dependencies/pom.xml +++ b/spring-cloud-config-dependencies/pom.xml @@ -6,11 +6,11 @@ spring-cloud-dependencies-parent org.springframework.cloud - 4.1.5 + 4.1.5-SNAPSHOT spring-cloud-config-dependencies - 4.1.5 + 4.1.5-SNAPSHOT pom spring-cloud-config-dependencies Spring Cloud Config Dependencies diff --git a/spring-cloud-config-monitor/pom.xml b/spring-cloud-config-monitor/pom.xml index 28f053a6..3e741368 100644 --- a/spring-cloud-config-monitor/pom.xml +++ b/spring-cloud-config-monitor/pom.xml @@ -6,7 +6,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5 + 4.1.5-SNAPSHOT .. spring-cloud-config-monitor @@ -14,7 +14,7 @@ Spring Cloud Config Monitor ${basedir}/../.. - 4.1.3 + 4.1.4-SNAPSHOT diff --git a/spring-cloud-config-sample/pom.xml b/spring-cloud-config-sample/pom.xml index 6dcdbc8a..f7318702 100644 --- a/spring-cloud-config-sample/pom.xml +++ b/spring-cloud-config-sample/pom.xml @@ -13,7 +13,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5 + 4.1.5-SNAPSHOT .. diff --git a/spring-cloud-config-server/pom.xml b/spring-cloud-config-server/pom.xml index d98760b1..b2f333c5 100644 --- a/spring-cloud-config-server/pom.xml +++ b/spring-cloud-config-server/pom.xml @@ -13,7 +13,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5 + 4.1.5-SNAPSHOT .. diff --git a/spring-cloud-starter-config/pom.xml b/spring-cloud-starter-config/pom.xml index 99074c9b..e13eceb3 100644 --- a/spring-cloud-starter-config/pom.xml +++ b/spring-cloud-starter-config/pom.xml @@ -6,10 +6,10 @@ org.springframework.cloud spring-cloud-config - 4.1.5 + 4.1.5-SNAPSHOT spring-cloud-starter-config - 4.1.5 + 4.1.5-SNAPSHOT spring-cloud-starter-config Spring Cloud Starter https://projects.spring.io/spring-cloud From dc8a53f5aa68866d596e8eb6d096790af889b535 Mon Sep 17 00:00:00 2001 From: spring-builds Date: Fri, 10 Jan 2025 00:11:19 +0000 Subject: [PATCH 3/6] Bumping versions to 4.1.6-SNAPSHOT after release --- docs/pom.xml | 2 +- pom.xml | 2 +- spring-cloud-config-client-tls-tests/pom.xml | 2 +- spring-cloud-config-client/pom.xml | 2 +- spring-cloud-config-dependencies/pom.xml | 2 +- spring-cloud-config-monitor/pom.xml | 2 +- spring-cloud-config-sample/pom.xml | 2 +- spring-cloud-config-server/pom.xml | 2 +- spring-cloud-starter-config/pom.xml | 4 ++-- 9 files changed, 10 insertions(+), 10 deletions(-) diff --git a/docs/pom.xml b/docs/pom.xml index 71916461..83b54e30 100644 --- a/docs/pom.xml +++ b/docs/pom.xml @@ -8,7 +8,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.6-SNAPSHOT .. jar diff --git a/pom.xml b/pom.xml index ffffcc6b..352a0ecb 100644 --- a/pom.xml +++ b/pom.xml @@ -5,7 +5,7 @@ 4.0.0 org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.6-SNAPSHOT pom Spring Cloud Config Spring Cloud Config diff --git a/spring-cloud-config-client-tls-tests/pom.xml b/spring-cloud-config-client-tls-tests/pom.xml index 664d162d..2535365d 100644 --- a/spring-cloud-config-client-tls-tests/pom.xml +++ b/spring-cloud-config-client-tls-tests/pom.xml @@ -9,7 +9,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.6-SNAPSHOT .. diff --git a/spring-cloud-config-client/pom.xml b/spring-cloud-config-client/pom.xml index eca1c03a..a15fd695 100644 --- a/spring-cloud-config-client/pom.xml +++ b/spring-cloud-config-client/pom.xml @@ -10,7 +10,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.6-SNAPSHOT .. diff --git a/spring-cloud-config-dependencies/pom.xml b/spring-cloud-config-dependencies/pom.xml index 6be02b96..51076cb6 100644 --- a/spring-cloud-config-dependencies/pom.xml +++ b/spring-cloud-config-dependencies/pom.xml @@ -10,7 +10,7 @@ spring-cloud-config-dependencies - 4.1.5-SNAPSHOT + 4.1.6-SNAPSHOT pom spring-cloud-config-dependencies Spring Cloud Config Dependencies diff --git a/spring-cloud-config-monitor/pom.xml b/spring-cloud-config-monitor/pom.xml index 3e741368..26ee2592 100644 --- a/spring-cloud-config-monitor/pom.xml +++ b/spring-cloud-config-monitor/pom.xml @@ -6,7 +6,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.6-SNAPSHOT .. spring-cloud-config-monitor diff --git a/spring-cloud-config-sample/pom.xml b/spring-cloud-config-sample/pom.xml index f7318702..68dec356 100644 --- a/spring-cloud-config-sample/pom.xml +++ b/spring-cloud-config-sample/pom.xml @@ -13,7 +13,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.6-SNAPSHOT .. diff --git a/spring-cloud-config-server/pom.xml b/spring-cloud-config-server/pom.xml index b2f333c5..6d686260 100644 --- a/spring-cloud-config-server/pom.xml +++ b/spring-cloud-config-server/pom.xml @@ -13,7 +13,7 @@ org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.6-SNAPSHOT .. diff --git a/spring-cloud-starter-config/pom.xml b/spring-cloud-starter-config/pom.xml index e13eceb3..b17c900d 100644 --- a/spring-cloud-starter-config/pom.xml +++ b/spring-cloud-starter-config/pom.xml @@ -6,10 +6,10 @@ org.springframework.cloud spring-cloud-config - 4.1.5-SNAPSHOT + 4.1.6-SNAPSHOT spring-cloud-starter-config - 4.1.5-SNAPSHOT + 4.1.6-SNAPSHOT spring-cloud-starter-config Spring Cloud Starter https://projects.spring.io/spring-cloud From d8b95261edfb464265c8b9bc930e95c5a2692745 Mon Sep 17 00:00:00 2001 From: spring-builds Date: Fri, 10 Jan 2025 00:12:14 +0000 Subject: [PATCH 4/6] Bumping dependency versions after release --- pom.xml | 4 ++-- spring-cloud-config-dependencies/pom.xml | 2 +- spring-cloud-config-monitor/pom.xml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index 352a0ecb..b5897206 100644 --- a/pom.xml +++ b/pom.xml @@ -13,7 +13,7 @@ org.springframework.cloud spring-cloud-build - 4.1.5-SNAPSHOT + 4.1.6-SNAPSHOT @@ -27,7 +27,7 @@ config - 4.1.6-SNAPSHOT + 4.1.5 2.18.41 v1-rev20201112-1.30.10 2.31.0 diff --git a/spring-cloud-config-dependencies/pom.xml b/spring-cloud-config-dependencies/pom.xml index 51076cb6..9968ee09 100644 --- a/spring-cloud-config-dependencies/pom.xml +++ b/spring-cloud-config-dependencies/pom.xml @@ -6,7 +6,7 @@ spring-cloud-dependencies-parent org.springframework.cloud - 4.1.5-SNAPSHOT + 4.1.6-SNAPSHOT spring-cloud-config-dependencies diff --git a/spring-cloud-config-monitor/pom.xml b/spring-cloud-config-monitor/pom.xml index 26ee2592..c418c599 100644 --- a/spring-cloud-config-monitor/pom.xml +++ b/spring-cloud-config-monitor/pom.xml @@ -14,7 +14,7 @@ Spring Cloud Config Monitor ${basedir}/../.. - 4.1.4-SNAPSHOT + 4.1.3 From 84fafcddeef48e164d824cafbaf214c8bdab0192 Mon Sep 17 00:00:00 2001 From: spring-builds Date: Tue, 14 Jan 2025 13:13:41 +0000 Subject: [PATCH 5/6] Bumping versions --- pom.xml | 2 +- spring-cloud-config-monitor/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index b5897206..c2f8e6b6 100644 --- a/pom.xml +++ b/pom.xml @@ -27,7 +27,7 @@ config - 4.1.5 + 4.1.6-SNAPSHOT 2.18.41 v1-rev20201112-1.30.10 2.31.0 diff --git a/spring-cloud-config-monitor/pom.xml b/spring-cloud-config-monitor/pom.xml index c418c599..26ee2592 100644 --- a/spring-cloud-config-monitor/pom.xml +++ b/spring-cloud-config-monitor/pom.xml @@ -14,7 +14,7 @@ Spring Cloud Config Monitor ${basedir}/../.. - 4.1.3 + 4.1.4-SNAPSHOT From 2d88fa05dbca398ba0931b2ef86b39d6cbcdc599 Mon Sep 17 00:00:00 2001 From: Ryan Baxter Date: Wed, 15 Jan 2025 16:09:44 -0500 Subject: [PATCH 6/6] Add property to disable adding invalid prefix when decryption fails (#2708) Fixes #2632 Signed-off-by: Ryan Baxter --- .../server/encryption-and-decryption.adoc | 73 +++++++++++++++++++ .../config/EncryptionAutoConfiguration.java | 8 +- .../VaultEncryptionAutoConfiguration.java | 9 ++- .../CipherEnvironmentEncryptor.java | 12 ++- .../vault/VaultEnvironmentEncryptor.java | 12 ++- .../CipherEnvironmentEncryptorTests.java | 51 +++++++++++++ .../vault/VaultEnvironmentEncryptorTests.java | 25 +++++++ 7 files changed, 184 insertions(+), 6 deletions(-) diff --git a/docs/modules/ROOT/pages/server/encryption-and-decryption.adoc b/docs/modules/ROOT/pages/server/encryption-and-decryption.adoc index 1719de69..c793e975 100644 --- a/docs/modules/ROOT/pages/server/encryption-and-decryption.adoc +++ b/docs/modules/ROOT/pages/server/encryption-and-decryption.adoc @@ -77,3 +77,76 @@ AQAjPgt3eFZQXwt8tsHAVv/QHiY5sI2dRcR+... NOTE: The `--key` argument is mandatory (despite having a `--` prefix). +== Decryption Errors + +When the config server fails to decrypt a value it will create an `invalid` property in the HTTP response. + +For example + +[source,json] +---- +{ + "label": null, + "name": "application", + "profiles": [ + "prd" + ], + "propertySources": [ + { + "name": "file:/demo/configserver/application-prd.yaml", + "source": { + "invalid.SharedPassword": "" + } + }, + { + "name": "file:/demo/configserver/application.yaml", + "source": { + "SharedPassword": "Fill_me_in" + } + } + ], + "state": null, + "version": null +} + +---- + +In the example above the config server could not decrypt the value of `SharedPassword` in `application-prd.yaml` +so the config server prefixed the property name with `invalid`. + +If this response was received by the Config Client and then added to the app's `Environment` and the client +requested the value of `SharedPassword` it would get `Fill_me_in`. + +If you do not want the config server to prefix properties it can't decrypt wit `invalid` then you can set +`spring.cloud.config.server.encrypt.prefix-invalid-properties` to `false`. If you do this then the same response from +the config server would look like this: + +[source,json] +---- + "label": null, + "name": "application", + "profiles": [ + "prd" + ], + "propertySources": [ + { + "name": "file:/demo/configserver/application-prd.yaml", + "source": { + "SharedPassword": "AYBKlpcZpaR36OcRDQjNIQl6fmnddAQhetMw/uyTpnn5fDj+unJ9QOEbqiPc9fX0N+CC8i+EJiN6nlH9Xqu6sH1tX/P6zg1CIy+ct/1RWGNbmQ256jc6vQaXhiN8sA8Mr6QiqYnMoBd+Jni/Miir5G3a7G9MmjbEUASKJOhUlIFKqL1IqB81RBT/cv0bg9kAiy5VBF1WppxP/PwtjECzbeUi2Y1jbpYb98rnc/qmRO3ZJam9fDNcPpW09qGFhGgJIujca257F7G4guS2w/7haVzNoyRiwHzZ14oL8AIxHLMBSJJF19ULlsMAkROj9o9TnwhL9r4rX9sAWk28c5eq77+iVpmlT3yoRdZqvMqffzKiibDlzz95Gmms7V7mctxrhNVOOWTwMSJvk94Y9ZPenljKgPJIV3Z1cqqx+W8JxFFeelOuYvMEe4bOVBh1TepGzzdWVdYbylgXJy35uRTZ2drybUe5+jc0hiAuujHz0zdY1FwOHfwzSsSidlYn4syPeuytnxTzn7fbWXeXetTTtDlmLRf8MBSzXzDFWNH0cNGOCQ==" + } + }, + { + "name": "file:/demo/configserver/application.yaml", + "source": { + "SharedPassword": "Fill_me_in" + } + } + ], + "state": null, + "version": null +} +---- + +In this case if the config client were to receive the above response and requested that value +of `SharedPassword` from the `Environment` it would get the encrypted value back instead of +`Fill_me_in`. diff --git a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/EncryptionAutoConfiguration.java b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/EncryptionAutoConfiguration.java index 310fb975..0dfa415e 100644 --- a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/EncryptionAutoConfiguration.java +++ b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/EncryptionAutoConfiguration.java @@ -17,6 +17,7 @@ package org.springframework.cloud.config.server.config; import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.beans.factory.annotation.Value; import org.springframework.boot.autoconfigure.AutoConfigureAfter; import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; @@ -44,6 +45,9 @@ import org.springframework.security.crypto.encrypt.TextEncryptor; @AutoConfigureAfter(DefaultTextEncryptionAutoConfiguration.class) public class EncryptionAutoConfiguration { + @Value("${spring.cloud.config.server.encrypt.prefixInvalidProperties:${spring.cloud.config.server.encrypt.prefix-invalid-properties:true}}") + private boolean prefixInvalidProperties; + @Bean @ConditionalOnBean(TextEncryptor.class) @ConditionalOnMissingBean(TextEncryptorLocator.class) @@ -60,7 +64,9 @@ public class EncryptionAutoConfiguration { if (locator == null) { locator = new SingleTextEncryptorLocator(encryptor); } - return new CipherEnvironmentEncryptor(locator); + CipherEnvironmentEncryptor environmentEncryptor = new CipherEnvironmentEncryptor(locator); + environmentEncryptor.setPrefixInvalidProperties(prefixInvalidProperties); + return environmentEncryptor; } } diff --git a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/VaultEncryptionAutoConfiguration.java b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/VaultEncryptionAutoConfiguration.java index bc7f3bad..55e44e21 100644 --- a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/VaultEncryptionAutoConfiguration.java +++ b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/VaultEncryptionAutoConfiguration.java @@ -16,6 +16,7 @@ package org.springframework.cloud.config.server.config; +import org.springframework.beans.factory.annotation.Value; import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.cloud.config.server.encryption.vault.VaultEnvironmentEncryptor; import org.springframework.cloud.config.server.environment.vault.SpringVaultEnvironmentRepository; @@ -34,10 +35,16 @@ import org.springframework.vault.core.VaultTemplate; @Profile("vault") public class VaultEncryptionAutoConfiguration { + @Value("${spring.cloud.config.server.encrypt.prefixInvalidProperties:${spring.cloud.config.server.encrypt.prefix-invalid-properties:true}}") + private boolean prefixInvalidProperties; + @Bean public VaultEnvironmentEncryptor vaultEnvironmentEncryptor( SpringVaultEnvironmentRepository vaultEnvironmentRepository) { - return new VaultEnvironmentEncryptor(vaultEnvironmentRepository.getKeyValueTemplate()); + VaultEnvironmentEncryptor vaultEnvironmentEncryptor = new VaultEnvironmentEncryptor( + vaultEnvironmentRepository.getKeyValueTemplate()); + vaultEnvironmentEncryptor.setPrefixInvalidProperties(this.prefixInvalidProperties); + return vaultEnvironmentEncryptor; } } diff --git a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/CipherEnvironmentEncryptor.java b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/CipherEnvironmentEncryptor.java index fedc75c7..f2e7b469 100644 --- a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/CipherEnvironmentEncryptor.java +++ b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/CipherEnvironmentEncryptor.java @@ -44,6 +44,8 @@ public class CipherEnvironmentEncryptor implements EnvironmentEncryptor { private final TextEncryptorLocator encryptor; + private boolean prefixInvalidProperties = true; + private EnvironmentPrefixHelper helper = new EnvironmentPrefixHelper(); @Autowired @@ -74,8 +76,10 @@ public class CipherEnvironmentEncryptor implements EnvironmentEncryptor { .decrypt(this.helper.stripPrefix(value)); } catch (Exception e) { - value = ""; - name = "invalid." + name; + if (this.prefixInvalidProperties) { + value = ""; + name = "invalid." + name; + } String message = "Cannot decrypt key: " + key + " (" + e.getClass() + ": " + e.getMessage() + ")"; if (logger.isDebugEnabled()) { @@ -93,4 +97,8 @@ public class CipherEnvironmentEncryptor implements EnvironmentEncryptor { return result; } + public void setPrefixInvalidProperties(boolean prefixInvalidProperties) { + this.prefixInvalidProperties = prefixInvalidProperties; + } + } diff --git a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/vault/VaultEnvironmentEncryptor.java b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/vault/VaultEnvironmentEncryptor.java index 073f1598..ab2412b6 100644 --- a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/vault/VaultEnvironmentEncryptor.java +++ b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/encryption/vault/VaultEnvironmentEncryptor.java @@ -44,6 +44,8 @@ public class VaultEnvironmentEncryptor implements EnvironmentEncryptor { private final VaultKeyValueOperations keyValueTemplate; + private boolean prefixInvalidProperties = true; + public VaultEnvironmentEncryptor(VaultKeyValueOperations keyValueTemplate) { this.keyValueTemplate = keyValueTemplate; } @@ -102,8 +104,10 @@ public class VaultEnvironmentEncryptor implements EnvironmentEncryptor { } } catch (Exception e) { - value = ""; - name = "invalid." + name; + if (this.prefixInvalidProperties) { + value = ""; + name = "invalid." + name; + } String message = "Cannot resolve key: " + key + " (" + e.getClass() + ": " + e.getMessage() + ")"; if (logger.isDebugEnabled()) { @@ -121,4 +125,8 @@ public class VaultEnvironmentEncryptor implements EnvironmentEncryptor { return result; } + public void setPrefixInvalidProperties(boolean prefixInvalidProperties) { + this.prefixInvalidProperties = prefixInvalidProperties; + } + } diff --git a/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/CipherEnvironmentEncryptorTests.java b/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/CipherEnvironmentEncryptorTests.java index 71fb02fc..0c134883 100644 --- a/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/CipherEnvironmentEncryptorTests.java +++ b/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/CipherEnvironmentEncryptorTests.java @@ -119,4 +119,55 @@ public class CipherEnvironmentEncryptorTests { .isEqualTo(secret); } + @ParameterizedTest + @MethodSource("params") + public void shouldDecryptFailed(String salt, String key) { + TextEncryptor textEncryptor = new EncryptorFactory(salt).create(key); + CipherEnvironmentEncryptor encryptor = new CipherEnvironmentEncryptor(keys -> textEncryptor); + encryptor.setPrefixInvalidProperties(true); + // given + String secret = randomUUID().toString(); + + // when + Environment environment = new Environment("name", "profile", "label"); + String encrypted = "{cipher}" + new EncryptorFactory(salt).create("dummykey").encrypt(secret); + environment.add(new PropertySource("a", Collections.singletonMap(environment.getName(), + new PropertyValueDescriptor(encrypted, "encrypted value")))); + + // then + assertThat(encryptor.decrypt(environment) + .getPropertySources() + .get(0) + .getSource() + .get("invalid." + environment.getName())).isEqualTo(""); + assertThat(encryptor.decrypt(environment).getPropertySources().get(0).getSource().get(environment.getName())) + .isNull(); + } + + @ParameterizedTest + @MethodSource("params") + public void decryptFailedWithoutInvalidPrefix(String salt, String key) { + TextEncryptor textEncryptor = new EncryptorFactory(salt).create(key); + CipherEnvironmentEncryptor encryptor = new CipherEnvironmentEncryptor(keys -> textEncryptor); + encryptor.setPrefixInvalidProperties(false); + // given + String secret = randomUUID().toString(); + + // when + Environment environment = new Environment("name", "profile", "label"); + String encryptedSecret = new EncryptorFactory(salt).create("dummykey").encrypt(secret); + String encrypted = "{cipher}" + encryptedSecret; + environment.add(new PropertySource("a", Collections.singletonMap(environment.getName(), + new PropertyValueDescriptor(encrypted, "encrypted value")))); + + // then + assertThat(encryptor.decrypt(environment) + .getPropertySources() + .get(0) + .getSource() + .get("invalid." + environment.getName())).isNull(); + assertThat(encryptor.decrypt(environment).getPropertySources().get(0).getSource().get(environment.getName())) + .isEqualTo(encryptedSecret); + } + } diff --git a/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/vault/VaultEnvironmentEncryptorTests.java b/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/vault/VaultEnvironmentEncryptorTests.java index 617a75b2..9ee18c8b 100644 --- a/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/vault/VaultEnvironmentEncryptorTests.java +++ b/spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/encryption/vault/VaultEnvironmentEncryptorTests.java @@ -117,6 +117,31 @@ public class VaultEnvironmentEncryptorTests { .isEqualTo(""); } + @Test + public void shouldNotPrefixInvalidPropertyWithNoKeyValue() { + // given + String accounts = "accounts/mypay"; + String value = "{vault}:" + accounts; + + VaultKeyValueOperations keyValueTemplate = mock(VaultKeyValueOperations.class); + + VaultEnvironmentEncryptor encryptor = new VaultEnvironmentEncryptor(keyValueTemplate); + encryptor.setPrefixInvalidProperties(false); + + // when + Environment environment = new Environment("name", "profile", "label"); + environment + .add(new PropertySource("a", Collections.singletonMap(environment.getName(), value))); + + // then + Environment processedEnvironment = encryptor.decrypt(environment); + + assertThat(processedEnvironment.getPropertySources().get(0).getSource().get("invalid." + environment.getName())) + .isNull(); + assertThat(processedEnvironment.getPropertySources().get(0).getSource().get(environment.getName())) + .isEqualTo(accounts); + } + @Test public void shouldMarkAsInvalidPropertyWithNoEmptyValue() { // given