crypt_keeper 0.18.1 → 0.18.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 546bb7aa3367ddbf34fd11da51b3b36532eb7486
-  data.tar.gz: 175bc48b58322dd5a59b04ab885dde2f907d40a0
+  metadata.gz: 7f892ea12e8ebe78efc372c995b6046043839599
+  data.tar.gz: 5c058382eed934967e33b4cc4f68644712b4a4d9
 SHA512:
-  metadata.gz: e76ab7631ea88e368017c1c33239f65a9a3f15edb84618134f776e4d8b947def43109f990cfff8d150adc313a39ddee0246be680c32a2aa924d4292cf3f343a4
-  data.tar.gz: ce6e2576f67345a2922e72cc65fd4e03f80c1bc4b620fe45dabaef2f1305ed7754204b6b485fca675c88ef8c294bbb921669fc316773def314b2be06422ebb01
+  metadata.gz: 708f2a385bd0bab815a376dfc4252bf5791a76d53c29e1affdf633a046ebcc4811a27610175d40f3cb6bed1062cee33b1ebe22777298a217befbee39de6938c8
+  data.tar.gz: b6585ed554225f21b49cdc9384bd2a83e9601368430bd44282af3ae31b0e07c452fa3a9210f699204fb2dc3e35d4a1d9e35d8695f73e3ff92bfa0d3d2f147a29

data/gemfiles/activerecord_3_1.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../
   specs:
-    crypt_keeper (0.18.0)
+    crypt_keeper (0.18.1)
       activerecord (>= 3.1, < 4.2)
       activesupport (>= 3.1, < 4.2)
       aes (~> 0.5.0)

data/gemfiles/activerecord_3_2.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../
   specs:
-    crypt_keeper (0.18.0)
+    crypt_keeper (0.18.1)
       activerecord (>= 3.1, < 4.2)
       activesupport (>= 3.1, < 4.2)
       aes (~> 0.5.0)

data/gemfiles/activerecord_4_0.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../
   specs:
-    crypt_keeper (0.18.0)
+    crypt_keeper (0.18.1)
       activerecord (>= 3.1, < 4.2)
       activesupport (>= 3.1, < 4.2)
       aes (~> 0.5.0)

data/gemfiles/activerecord_4_1.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../
   specs:
-    crypt_keeper (0.18.0)
+    crypt_keeper (0.18.1)
       activerecord (>= 3.1, < 4.2)
       activesupport (>= 3.1, < 4.2)
       aes (~> 0.5.0)

data/lib/crypt_keeper/log_subscriber/mysql_aes.rb

@@ -12,9 +12,11 @@ module CryptKeeper
 
       # Public: Prevents sensitive data from being logged
       def sql_with_mysql_aes(event)
-        filter = /(aes_(encrypt|decrypt))\(.*\)/i
+        filter  = /(aes_(encrypt|decrypt))\(.*\)/i
+        payload = event.payload[:sql]
+          .encode('UTF-8', 'binary', invalid: :replace, undef: :replace, replace: '')
 
-        event.payload[:sql] = event.payload[:sql].gsub(filter) do |_|
+        event.payload[:sql] = payload.gsub(filter) do |_|
           "#{$1}([FILTERED])"
         end
 

data/lib/crypt_keeper/log_subscriber/postgres_pgp.rb

@@ -12,9 +12,11 @@ module CryptKeeper
 
       # Public: Prevents sensitive data from being logged
       def sql_with_postgres_pgp(event)
-        filter = /(\(*)pgp_(sym|pub)_(?<operation>decrypt|encrypt)(\(+.*\)+)/im
+        filter  = /(\(*)pgp_(sym|pub)_(?<operation>decrypt|encrypt)(\(+.*\)+)/im
+        payload = event.payload[:sql]
+          .encode('UTF-8', 'binary', invalid: :replace, undef: :replace, replace: '')
 
-        event.payload[:sql] = event.payload[:sql].gsub(filter) do |_|
+        event.payload[:sql] = payload.gsub(filter) do |_|
           "#{$~[:operation]}([FILTERED])"
         end
 

data/lib/crypt_keeper/version.rb

@@ -1,3 +1,3 @@
 module CryptKeeper
-  VERSION = "0.18.1"
+  VERSION = "0.18.2"
 end

data/spec/log_subscriber/mysql_aes_spec.rb

@@ -0,0 +1,61 @@
+require 'spec_helper'
+
+module CryptKeeper::LogSubscriber
+  describe MysqlAes do
+    use_mysql
+
+    context "AES encryption" do
+      # Fire the ActiveSupport.on_load
+      before do
+        CryptKeeper::Provider::MysqlAesNew.new key: 'secret', salt: 'salt'
+      end
+
+      subject { ::ActiveRecord::LogSubscriber.new }
+
+      let(:input_query) do
+        "SELECT aes_encrypt('encrypt_value', 'encrypt_key'), aes_decrypt('decrypt_value', 'decrypt_key') FROM DUAL;"
+      end
+
+      let(:output_query) do
+        "SELECT aes_encrypt([FILTERED]) FROM DUAL;"
+      end
+
+      let(:input_search_query) do
+        "SELECT \"sensitive_data\".* FROM \"sensitive_data\" WHERE ((aes_decrypt('f'), 'tool') = 'blah')) AND secret = 'testing'"
+      end
+
+      let(:output_search_query) do
+        "SELECT \"sensitive_data\".* FROM \"sensitive_data\" WHERE ((aes_decrypt([FILTERED]) AND secret = 'testing'"
+      end
+
+      it "filters aes functions" do
+        subject.should_receive(:sql_without_mysql_aes) do |event|
+          event.payload[:sql].should == output_query
+        end
+
+        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_query }))
+      end
+
+      it "filters aes functions in lowercase" do
+        subject.should_receive(:sql_without_mysql_aes) do |event|
+          event.payload[:sql].should == output_query.downcase.gsub(/filtered/, 'FILTERED')
+        end
+
+        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_query.downcase }))
+      end
+
+      it "filters aes functions when searching" do
+        subject.should_receive(:sql_without_mysql_aes) do |event|
+          event.payload[:sql].should == output_search_query
+        end
+
+        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_search_query }))
+      end
+
+      it "forces string encodings" do
+        string_encoding_query = "SELECT aes_encrypt('hi \255', 'test')"
+        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: string_encoding_query }))
+      end
+    end
+  end
+end

data/spec/log_subscriber/postgres_pgp_spec.rb

@@ -51,6 +51,11 @@ module CryptKeeper::LogSubscriber
 
         subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_search_query }))
       end
+
+      it "forces string encodings" do
+        string_encoding_query = "SELECT pgp_sym_encrypt('hi \255', 'test')"
+        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: string_encoding_query }))
+      end
     end
 
     context "Public key encryption" do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: crypt_keeper
 version: !ruby/object:Gem::Version
-  version: 0.18.1
+  version: 0.18.2
 platform: ruby
 authors:
 - Justin Mazzi
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-06-14 00:00:00.000000000 Z
+date: 2014-08-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -260,6 +260,7 @@ files:
 - spec/default.database.yml
 - spec/fixtures/private.asc
 - spec/fixtures/public.asc
+- spec/log_subscriber/mysql_aes_spec.rb
 - spec/log_subscriber/postgres_pgp_spec.rb
 - spec/model_spec.rb
 - spec/provider/aes_new_spec.rb
@@ -299,6 +300,7 @@ test_files:
 - spec/default.database.yml
 - spec/fixtures/private.asc
 - spec/fixtures/public.asc
+- spec/log_subscriber/mysql_aes_spec.rb
 - spec/log_subscriber/postgres_pgp_spec.rb
 - spec/model_spec.rb
 - spec/provider/aes_new_spec.rb