Upgrade attr_encrypted and encryptor

attr_encrypted (1.3.4 => 3.0.1) Changelog:
https://github.com/attr-encrypted/attr_encrypted/blob/master/CHANGELOG.m
d

attr_encrypted 2.x included a vulnerability, so that major version is
skipped. 3.x requires that the algorithm and mode used by each
encrypted attribute is specified explicitly.

`nil` is no longer a valid value for the encrypted_value_iv field, so
it’s changed to a randomly generated string.
parent d47b2b92
...@@ -44,7 +44,7 @@ gem 'akismet', '~> 2.0' ...@@ -44,7 +44,7 @@ gem 'akismet', '~> 2.0'
# Two-factor authentication # Two-factor authentication
gem 'devise-two-factor', '~> 3.0.0' gem 'devise-two-factor', '~> 3.0.0'
gem 'rqrcode-rails3', '~> 0.1.7' gem 'rqrcode-rails3', '~> 0.1.7'
gem 'attr_encrypted', '~> 1.3.4' gem 'attr_encrypted', '~> 3.0.0'
# Browser detection # Browser detection
gem "browser", '~> 1.0.0' gem "browser", '~> 1.0.0'
......
...@@ -60,8 +60,8 @@ GEM ...@@ -60,8 +60,8 @@ GEM
oauth2 (~> 1.0) oauth2 (~> 1.0)
asciidoctor (1.5.3) asciidoctor (1.5.3)
ast (2.2.0) ast (2.2.0)
attr_encrypted (1.3.4) attr_encrypted (3.0.1)
encryptor (>= 1.3.0) encryptor (~> 3.0.0)
attr_required (1.0.0) attr_required (1.0.0)
autoprefixer-rails (6.2.3) autoprefixer-rails (6.2.3)
execjs execjs
...@@ -178,7 +178,7 @@ GEM ...@@ -178,7 +178,7 @@ GEM
email_spec (1.6.0) email_spec (1.6.0)
launchy (~> 2.1) launchy (~> 2.1)
mail (~> 2.2) mail (~> 2.2)
encryptor (1.3.0) encryptor (3.0.0)
equalizer (0.0.11) equalizer (0.0.11)
erubis (2.7.0) erubis (2.7.0)
escape_utils (1.1.1) escape_utils (1.1.1)
...@@ -891,7 +891,7 @@ DEPENDENCIES ...@@ -891,7 +891,7 @@ DEPENDENCIES
allocations (~> 1.0) allocations (~> 1.0)
asana (~> 0.4.0) asana (~> 0.4.0)
asciidoctor (~> 1.5.2) asciidoctor (~> 1.5.2)
attr_encrypted (~> 1.3.4) attr_encrypted (~> 3.0.0)
awesome_print (~> 1.2.0) awesome_print (~> 1.2.0)
babosa (~> 1.0.2) babosa (~> 1.0.2)
base32 (~> 0.3.0) base32 (~> 0.3.0)
......
...@@ -11,6 +11,9 @@ module Ci ...@@ -11,6 +11,9 @@ module Ci
format: { with: /\A[a-zA-Z0-9_]+\z/, format: { with: /\A[a-zA-Z0-9_]+\z/,
message: "can contain only letters, digits and '_'." } message: "can contain only letters, digits and '_'." }
attr_encrypted :value, mode: :per_attribute_iv_and_salt, key: Gitlab::Application.secrets.db_key_base attr_encrypted :value,
mode: :per_attribute_iv_and_salt,
key: Gitlab::Application.secrets.db_key_base,
algorithm: 'aes-256-cbc'
end end
end end
...@@ -6,7 +6,8 @@ class ProjectImportData < ActiveRecord::Base ...@@ -6,7 +6,8 @@ class ProjectImportData < ActiveRecord::Base
key: Gitlab::Application.secrets.db_key_base, key: Gitlab::Application.secrets.db_key_base,
marshal: true, marshal: true,
encode: true, encode: true,
mode: :per_attribute_iv_and_salt mode: :per_attribute_iv_and_salt,
algorithm: 'aes-256-cbc'
serialize :data, JSON serialize :data, JSON
......
...@@ -20,6 +20,11 @@ class User < ActiveRecord::Base ...@@ -20,6 +20,11 @@ class User < ActiveRecord::Base
default_value_for :hide_no_password, false default_value_for :hide_no_password, false
default_value_for :theme_id, gitlab_config.default_theme default_value_for :theme_id, gitlab_config.default_theme
attr_encrypted :otp_secret,
key: Gitlab::Application.config.secret_key_base,
mode: :per_attribute_iv_and_salt,
algorithm: 'aes-256-cbc'
devise :two_factor_authenticatable, devise :two_factor_authenticatable,
otp_secret_encryption_key: Gitlab::Application.config.secret_key_base otp_secret_encryption_key: Gitlab::Application.config.secret_key_base
alias_attribute :two_factor_enabled, :otp_required_for_login alias_attribute :two_factor_enabled, :otp_required_for_login
......
...@@ -121,7 +121,7 @@ feature 'Login', feature: true do ...@@ -121,7 +121,7 @@ feature 'Login', feature: true do
user = create(:user, password: 'not-the-default') user = create(:user, password: 'not-the-default')
login_with(user) login_with(user)
expect(page).to have_content('Invalid login or password.') expect(page).to have_content('Invalid Login or password.')
end end
end end
......
...@@ -23,7 +23,7 @@ describe Ci::Variable, models: true do ...@@ -23,7 +23,7 @@ describe Ci::Variable, models: true do
end end
it 'fails to decrypt if iv is incorrect' do it 'fails to decrypt if iv is incorrect' do
subject.encrypted_value_iv = nil subject.encrypted_value_iv = SecureRandom.hex
subject.instance_variable_set(:@value, nil) subject.instance_variable_set(:@value, nil)
expect { subject.value }. expect { subject.value }.
to raise_error(OpenSSL::Cipher::CipherError, 'bad decrypt') to raise_error(OpenSSL::Cipher::CipherError, 'bad decrypt')
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment