mirror of
https://github.com/getsops/sops.git
synced 2026-02-05 21:45:26 +01:00
97ce8a62c9
SOPS failed to decrypt empty comments before after they were encrypted because they would look like: `#ENC[AES256_GCM,data:,iv:NVQvG25goSE7xi6U/QjRNtJBwr/VfChezSptI8GFsQk=,tag:yyYIW/hiIZ1qK1GEo8vHpA==,type:comment]` Note the empty "data" value. SOPS would fail to decrypt those and show them to the user "encrypted" when decrypting the file.
124 lines
2.7 KiB
Go
124 lines
2.7 KiB
Go
package aes
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"strings"
|
|
"testing"
|
|
"testing/quick"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"go.mozilla.org/sops"
|
|
)
|
|
|
|
func TestDecrypt(t *testing.T) {
|
|
expected := "foo"
|
|
key := []byte(strings.Repeat("f", 32))
|
|
message := `ENC[AES256_GCM,data:oYyi,iv:MyIDYbT718JRr11QtBkcj3Dwm4k1aCGZBVeZf0EyV8o=,tag:t5z2Z023Up0kxwCgw1gNxg==,type:str]`
|
|
decryption, err := NewCipher().Decrypt(message, key, "bar:")
|
|
if err != nil {
|
|
t.Errorf("%s", err)
|
|
}
|
|
if decryption != expected {
|
|
t.Errorf("Decrypt(\"%s\", \"%s\") == \"%s\", expected %s", message, key, decryption, expected)
|
|
}
|
|
}
|
|
|
|
func TestDecryptInvalidAad(t *testing.T) {
|
|
message := `ENC[AES256_GCM,data:oYyi,iv:MyIDYbT718JRr11QtBkcj3Dwm4k1aCGZBVeZf0EyV8o=,tag:t5z2Z023Up0kxwCgw1gNxg==,type:str]`
|
|
_, err := NewCipher().Decrypt(message, []byte(strings.Repeat("f", 32)), "")
|
|
if err == nil {
|
|
t.Errorf("Decrypting with an invalid AAC should fail")
|
|
}
|
|
}
|
|
|
|
func TestRoundtripString(t *testing.T) {
|
|
f := func(x, aad string) bool {
|
|
key := make([]byte, 32)
|
|
rand.Read(key)
|
|
s, err := NewCipher().Encrypt(x, key, aad)
|
|
if err != nil {
|
|
log.Println(err)
|
|
return false
|
|
}
|
|
d, err := NewCipher().Decrypt(s, key, aad)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
return x == d
|
|
}
|
|
if err := quick.Check(f, nil); err != nil {
|
|
t.Error(err)
|
|
}
|
|
}
|
|
|
|
func TestRoundtripFloat(t *testing.T) {
|
|
key := []byte(strings.Repeat("f", 32))
|
|
f := func(x float64) bool {
|
|
s, err := NewCipher().Encrypt(x, key, "")
|
|
if err != nil {
|
|
log.Println(err)
|
|
return false
|
|
}
|
|
d, err := NewCipher().Decrypt(s, key, "")
|
|
if err != nil {
|
|
return false
|
|
}
|
|
return x == d
|
|
}
|
|
if err := quick.Check(f, nil); err != nil {
|
|
t.Error(err)
|
|
}
|
|
}
|
|
|
|
func TestRoundtripInt(t *testing.T) {
|
|
key := []byte(strings.Repeat("f", 32))
|
|
f := func(x int) bool {
|
|
s, err := NewCipher().Encrypt(x, key, "")
|
|
if err != nil {
|
|
log.Println(err)
|
|
return false
|
|
}
|
|
d, err := NewCipher().Decrypt(s, key, "")
|
|
if err != nil {
|
|
return false
|
|
}
|
|
return x == d
|
|
}
|
|
if err := quick.Check(f, nil); err != nil {
|
|
t.Error(err)
|
|
}
|
|
}
|
|
|
|
func TestRoundtripBool(t *testing.T) {
|
|
key := []byte(strings.Repeat("f", 32))
|
|
f := func(x bool) bool {
|
|
s, err := NewCipher().Encrypt(x, key, "")
|
|
if err != nil {
|
|
log.Println(err)
|
|
return false
|
|
}
|
|
d, err := NewCipher().Decrypt(s, key, "")
|
|
if err != nil {
|
|
return false
|
|
}
|
|
return x == d
|
|
}
|
|
if err := quick.Check(f, nil); err != nil {
|
|
t.Error(err)
|
|
}
|
|
}
|
|
|
|
func TestEncryptEmptyComment(t *testing.T) {
|
|
key := []byte(strings.Repeat("f", 32))
|
|
s, err := NewCipher().Encrypt(sops.Comment{}, key, "")
|
|
assert.Nil(t, err)
|
|
assert.Equal(t, "", s)
|
|
}
|
|
|
|
func TestDecryptEmptyValue(t *testing.T) {
|
|
key := []byte(strings.Repeat("f", 32))
|
|
s, err := NewCipher().Decrypt("", key, "")
|
|
assert.Nil(t, err)
|
|
assert.Equal(t, "", s)
|
|
}
|