crypt_keeper 0.22.0 → 1.0.0.beta1

data/gemfiles/activerecord_4_2.gemfile.lock

@@ -1,120 +0,0 @@
-PATH
-  remote: ../
-  specs:
-    crypt_keeper (0.21.0)
-      activerecord (>= 3.1, < 4.3)
-      activesupport (>= 3.1, < 4.3)
-      aes (~> 0.5.0)
-      armor (~> 0.0.2)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    activemodel (4.2.6)
-      activesupport (= 4.2.6)
-      builder (~> 3.1)
-    activerecord (4.2.6)
-      activemodel (= 4.2.6)
-      activesupport (= 4.2.6)
-      arel (~> 6.0)
-    activesupport (4.2.6)
-      i18n (~> 0.7)
-      json (~> 1.7, >= 1.7.7)
-      minitest (~> 5.1)
-      thread_safe (~> 0.3, >= 0.3.4)
-      tzinfo (~> 1.1)
-    aes (0.5.0)
-    appraisal (1.0.3)
-      bundler
-      rake
-      thor (>= 0.14.0)
-    arel (6.0.3)
-    armor (0.0.3)
-    builder (3.2.2)
-    celluloid (0.16.0)
-      timers (~> 4.0.0)
-    coderay (1.1.1)
-    coveralls (0.8.13)
-      json (~> 1.8)
-      simplecov (~> 0.11.0)
-      term-ansicolor (~> 1.3)
-      thor (~> 0.19.1)
-      tins (~> 1.6.0)
-    diff-lcs (1.2.5)
-    docile (1.1.5)
-    ffi (1.9.10)
-    formatador (0.2.5)
-    guard (2.6.1)
-      formatador (>= 0.2.4)
-      listen (~> 2.7)
-      lumberjack (~> 1.0)
-      pry (>= 0.9.12)
-      thor (>= 0.18.1)
-    guard-rspec (4.2.10)
-      guard (~> 2.1)
-      rspec (>= 2.14, < 4.0)
-    hitimes (1.2.4)
-    i18n (0.7.0)
-    json (1.8.3)
-    listen (2.10.1)
-      celluloid (~> 0.16.0)
-      rb-fsevent (>= 0.9.3)
-      rb-inotify (>= 0.9)
-    lumberjack (1.0.10)
-    method_source (0.8.2)
-    minitest (5.9.0)
-    mysql2 (0.3.21)
-    pg (0.17.1)
-    pry (0.10.3)
-      coderay (~> 1.1.0)
-      method_source (~> 0.8.1)
-      slop (~> 3.4)
-    rake (10.3.2)
-    rb-fsevent (0.9.7)
-    rb-inotify (0.9.7)
-      ffi (>= 0.5.0)
-    rspec (2.14.1)
-      rspec-core (~> 2.14.0)
-      rspec-expectations (~> 2.14.0)
-      rspec-mocks (~> 2.14.0)
-    rspec-core (2.14.8)
-    rspec-expectations (2.14.5)
-      diff-lcs (>= 1.1.3, < 2.0)
-    rspec-mocks (2.14.6)
-    simplecov (0.11.2)
-      docile (~> 1.1.0)
-      json (~> 1.8)
-      simplecov-html (~> 0.10.0)
-    simplecov-html (0.10.0)
-    slop (3.6.0)
-    sqlite3 (1.3.11)
-    term-ansicolor (1.3.2)
-      tins (~> 1.0)
-    thor (0.19.1)
-    thread_safe (0.3.5)
-    timers (4.0.4)
-      hitimes
-    tins (1.6.0)
-    tzinfo (1.2.2)
-      thread_safe (~> 0.1)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  activerecord (~> 4.2.0)
-  activesupport (~> 4.2.0)
-  appraisal (~> 1.0.0)
-  coveralls
-  crypt_keeper!
-  guard (~> 2.6.1)
-  guard-rspec (~> 4.2.9)
-  mysql2 (~> 0.3.11)
-  pg (~> 0.17.1)
-  rake (~> 10.3.1)
-  rb-fsevent (~> 0.9.1)
-  rspec (~> 2.14.0)
-  sqlite3
-
-BUNDLED WITH
-   1.12.5

data/lib/crypt_keeper/provider/aes.rb

@@ -1,66 +0,0 @@
-require 'digest/sha2'
-require 'openssl'
-require 'base64'
-
-module CryptKeeper
-  module Provider
-    class Aes
-      SEPARATOR = ":crypt_keeper:"
-
-      # Public: The encryption key
-      attr_accessor :key
-
-      # Public: An instance of  OpenSSL::Cipher::Cipher
-      attr_accessor :aes
-
-      # Public: Initializes the class
-      #
-      #   options - A hash of options. :key is required
-      def initialize(options = {})
-        legacy
-        @aes         = ::OpenSSL::Cipher::Cipher.new("AES-256-CBC")
-        @aes.padding = 1
-
-        key = options.fetch(:key) do
-          raise ArgumentError, "Missing :key"
-        end
-
-        @key = Digest::SHA256.digest(key)
-      end
-
-      # Public: Encrypt a string
-      #
-      # Note: nil and empty strings are not encryptable with AES.
-      # When they are encountered, the orignal value is returned.
-      # Otherwise, returns the encrypted string
-      def encrypt(value)
-        return value if value == '' || value.nil?
-        aes.encrypt
-        aes.key = key
-        Base64::encode64("#{aes.random_iv}#{SEPARATOR}#{aes.update(value.to_s) + aes.final}")
-      end
-
-      # Public: Decrypt a string
-      #
-      # Note: nil and empty strings are not encryptable with AES (and thus cannot be decrypted).
-      # When they are encountered, the orignal value is returned.
-      # Otherwise, returns the decrypted string
-      def decrypt(value)
-        return value if value == '' || value.nil?
-        iv, value = Base64::decode64(value.to_s).split(SEPARATOR)
-        aes.decrypt
-        aes.key = key
-        aes.iv  = iv
-        aes.update(value) + aes.final
-      end
-
-      private
-
-      def legacy
-        unless ENV['CRYPT_KEEPER_IGNORE_LEGACY_DEPRECATION']
-          warn "[DEPRECATION] AES Legacy is now deprecated. Please see http://git.io/uYcp2A"
-        end
-      end
-    end
-  end
-end

data/lib/crypt_keeper/provider/mysql_aes.rb

@@ -1,47 +0,0 @@
-require 'crypt_keeper/log_subscriber/mysql_aes'
-
-module CryptKeeper
-  module Provider
-    class MysqlAes
-      include CryptKeeper::Helper::SQL
-
-      attr_accessor :key
-
-      # Public: Initializes the encryptor
-      #
-      #  options - A hash, :key is required
-      def initialize(options = {})
-        legacy
-        ActiveSupport.run_load_hooks(:crypt_keeper_mysql_aes_log, self)
-
-        @key = options.fetch(:key) do
-          raise ArgumentError, "Missing :key"
-        end
-      end
-
-      # Public: Encrypts a string
-      #
-      # Returns an encrypted string
-      def encrypt(value)
-        Base64.encode64 escape_and_execute_sql(
-          ["SELECT AES_ENCRYPT(?, ?)", value, key]).first
-      end
-
-      # Public: Decrypts a string
-      #
-      # Returns a plaintext string
-      def decrypt(value)
-        escape_and_execute_sql(
-          ["SELECT AES_DECRYPT(?, ?)", Base64.decode64(value), key]).first
-      end
-
-      private
-
-      def legacy
-        unless ENV['CRYPT_KEEPER_IGNORE_LEGACY_DEPRECATION']
-          warn "[DEPRECATION] MySqlAes Legacy is now deprecated. Please see http://git.io/nXXOlg"
-        end
-      end
-    end
-  end
-end

data/spec/log_subscriber/mysql_aes_spec.rb

@@ -1,73 +0,0 @@
-require 'spec_helper'
-
-module CryptKeeper::LogSubscriber
-  describe MysqlAes do
-    before do
-      CryptKeeper.silence_logs = false
-    end
-
-    use_mysql
-
-    context "AES encryption" do
-      # Fire the ActiveSupport.on_load
-      before do
-        CryptKeeper::Provider::MysqlAesNew.new key: 'secret', salt: 'salt'
-      end
-
-      subject { ::ActiveRecord::LogSubscriber.new }
-
-      let(:input_query) do
-        "SELECT aes_encrypt('encrypt_value', 'encrypt_key'), aes_decrypt('decrypt_value', 'decrypt_key') FROM DUAL;"
-      end
-
-      let(:output_query) do
-        "SELECT aes_encrypt([FILTERED]) FROM DUAL;"
-      end
-
-      let(:input_search_query) do
-        "SELECT \"sensitive_data\".* FROM \"sensitive_data\" WHERE ((aes_decrypt('f'), 'tool') = 'blah')) AND secret = 'testing'"
-      end
-
-      let(:output_search_query) do
-        "SELECT \"sensitive_data\".* FROM \"sensitive_data\" WHERE ((aes_decrypt([FILTERED]) AND secret = 'testing'"
-      end
-
-      it "filters aes functions" do
-        subject.should_receive(:sql_without_mysql_aes) do |event|
-          event.payload[:sql].should == output_query
-        end
-
-        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_query }))
-      end
-
-      it "filters aes functions in lowercase" do
-        subject.should_receive(:sql_without_mysql_aes) do |event|
-          event.payload[:sql].should == output_query.downcase.gsub(/filtered/, 'FILTERED')
-        end
-
-        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_query.downcase }))
-      end
-
-      it "filters aes functions when searching" do
-        subject.should_receive(:sql_without_mysql_aes) do |event|
-          event.payload[:sql].should == output_search_query
-        end
-
-        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_search_query }))
-      end
-
-      it "forces string encodings" do
-        string_encoding_query = "SELECT aes_encrypt('hi \255', 'test')"
-        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: string_encoding_query }))
-      end
-
-      it "skips logging if CryptKeeper.silence_logs is set" do
-        CryptKeeper.silence_logs = true
-
-        subject.should_not_receive(:sql_without_mysql_aes)
-
-        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_query }))
-      end
-    end
-  end
-end

data/spec/log_subscriber/postgres_pgp_spec.rb

@@ -1,123 +0,0 @@
-require 'spec_helper'
-
-module CryptKeeper::LogSubscriber
-  describe PostgresPgp do
-    before do
-      CryptKeeper.silence_logs = false
-    end
-
-    use_postgres
-
-    context "Symmetric encryption" do
-      # Fire the ActiveSupport.on_load
-      before do
-        CryptKeeper::Provider::PostgresPgp.new key: 'secret'
-      end
-
-      subject { ::ActiveRecord::LogSubscriber.new }
-
-      let(:input_query) do
-        "SELECT pgp_sym_encrypt('encrypt_value', 'encrypt_key'), pgp_sym_decrypt('decrypt_value', 'decrypt_key') FROM DUAL;"
-      end
-
-      let(:output_query) do
-        "SELECT encrypt([FILTERED]) FROM DUAL;"
-      end
-
-      let(:input_search_query) do
-        "SELECT \"sensitive_data\".* FROM \"sensitive_data\" WHERE ((pgp_sym_decrypt('f'), 'tool') = 'blah')) AND secret = 'testing'"
-      end
-
-      let(:output_search_query) do
-        "SELECT \"sensitive_data\".* FROM \"sensitive_data\" WHERE decrypt([FILTERED]) AND secret = 'testing'"
-      end
-
-      it "filters pgp functions" do
-        subject.should_receive(:sql_without_postgres_pgp) do |event|
-          event.payload[:sql].should == output_query
-        end
-
-        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_query }))
-      end
-
-      it "filters pgp functions in lowercase" do
-        subject.should_receive(:sql_without_postgres_pgp) do |event|
-          event.payload[:sql].should == output_query.downcase.gsub(/filtered/, 'FILTERED')
-        end
-
-        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_query.downcase }))
-      end
-
-      it "filters pgp functions when searching" do
-        subject.should_receive(:sql_without_postgres_pgp) do |event|
-          event.payload[:sql].should == output_search_query
-        end
-
-        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_search_query }))
-      end
-
-      it "forces string encodings" do
-        string_encoding_query = "SELECT pgp_sym_encrypt('hi \255', 'test')"
-        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: string_encoding_query }))
-      end
-
-      it "skips logging if CryptKeeper.silence_logs is set" do
-        CryptKeeper.silence_logs = true
-
-        subject.should_not_receive(:sql_without_postgres_pgp)
-
-        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_query }))
-      end
-    end
-
-    context "Public key encryption" do
-      let(:public_key) do
-        IO.read(File.join(SPEC_ROOT, 'fixtures', 'public.asc'))
-      end
-
-      let(:private_key) do
-        IO.read(File.join(SPEC_ROOT, 'fixtures', 'private.asc'))
-      end
-
-      # Fire the ActiveSupport.on_load
-      before do
-        CryptKeeper::Provider::PostgresPgpPublicKey.new key: 'secret', public_key: public_key, private_key: private_key
-      end
-
-      subject { ::ActiveRecord::LogSubscriber.new }
-
-      let(:input_query) do
-        "SELECT pgp_pub_encrypt('test', dearmor('#{public_key}
-        '))"
-      end
-
-      let(:output_query) do
-        "SELECT encrypt([FILTERED])"
-      end
-
-      it "filters pgp functions" do
-        subject.should_receive(:sql_without_postgres_pgp) do |event|
-          event.payload[:sql].should == output_query
-        end
-
-        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_query }))
-      end
-
-      it "filters pgp functions in lowercase" do
-        subject.should_receive(:sql_without_postgres_pgp) do |event|
-          event.payload[:sql].should == output_query.downcase.gsub(/filtered/, 'FILTERED')
-        end
-
-        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_query.downcase }))
-      end
-
-      it "skips logging if CryptKeeper.silence_logs is set" do
-        CryptKeeper.silence_logs = true
-
-        subject.should_not_receive(:sql_without_postgres_pgp)
-
-        subject.sql(ActiveSupport::Notifications::Event.new(:sql, 1, 1, 1, { sql: input_query }))
-      end
-    end
-  end
-end

data/spec/model_spec.rb

@@ -1,169 +0,0 @@
-# encoding: utf-8
-
-require 'spec_helper'
-
-module CryptKeeper
-  describe Model do
-    use_sqlite
-
-    subject { create_model }
-
-    after do
-      CryptKeeper.stub_encryption = false
-    end
-
-    describe "#crypt_keeper" do
-      context "Fields" do
-        it "enables encryption for the given fields" do
-          subject.crypt_keeper :storage, :secret, encryptor: :fake_encryptor
-          subject.crypt_keeper_fields.should == [:storage, :secret]
-        end
-
-        it "raises an exception for missing field" do
-          msg = "Column :none does not exist"
-          subject.crypt_keeper :none, encryptor: :fake_encryptor
-          expect { subject.new.save }.to raise_error(ArgumentError, msg)
-        end
-
-        it "raises an exception for non text fields" do
-          msg = "Column :name must be of type 'text' to be used for encryption"
-          subject.crypt_keeper :name, encryptor: :fake_encryptor
-          expect { subject.new.save }.to raise_error(ArgumentError, msg)
-        end
-      end
-
-      context "Options" do
-        it "accepts the class name as a string" do
-          subject.crypt_keeper :storage, :secret, key1: 1, key2: 2, encryptor: "FakeEncryptor"
-          subject.send(:encryptor_klass).should == CryptKeeper::Provider::FakeEncryptor
-        end
-
-        it "raises an error on missing encryptor" do
-          expect { subject.crypt_keeper :storage, :secret }.
-            to raise_error(RuntimeError, /You must specify a valid encryptor/)
-        end
-      end
-    end
-
-    context "Encryption and Decryption" do
-      let(:plain_text) { 'plain_text' }
-      let(:cipher_text) { 'tooltxet_nialp' }
-
-      subject { create_encrypted_model :storage, passphrase: 'tool', encryptor: :encryptor }
-
-      it "encrypts the data" do
-        CryptKeeper::Provider::Encryptor.any_instance.should_receive(:encrypt).with('testing')
-        subject.create!(storage: 'testing')
-      end
-
-      it "decrypts the data" do
-        record = subject.create!(storage: 'testing')
-        CryptKeeper::Provider::Encryptor.any_instance.should_receive(:decrypt).at_least(1).times.with('toolgnitset')
-        subject.find(record.id).storage
-      end
-
-      it "returns the plaintext on decrypt" do
-        record = subject.create!(storage: 'testing')
-        subject.find(record.id).storage.should == 'testing'
-      end
-
-      it "does not encrypt or decrypt nil" do
-        data = subject.create!(storage: nil)
-        data.storage.should be_nil
-      end
-
-      it "does not encrypt or decrypt empty strings" do
-        data = subject.create!(storage: "")
-        data.storage.should be_empty
-      end
-
-      it "converts numbers to strings" do
-        data = subject.create!(storage: 1)
-        data.reload.storage.should == "1"
-      end
-
-      it "does not decrypt when stubbing is enabled" do
-        CryptKeeper.stub_encryption = true
-        record = subject.create!(storage: "testing")
-        CryptKeeper::Provider::Encryptor.any_instance.should_not_receive(:decrypt)
-        subject.find(record.id).storage
-      end
-
-      it "does not decrypt when stubbing is enabled after model is created" do
-        record = subject.create!(storage: "testing")
-        CryptKeeper.stub_encryption = true
-        CryptKeeper::Provider::Encryptor.any_instance.should_not_receive(:decrypt)
-        subject.find(record.id).storage
-      end
-    end
-
-    context "Search" do
-      subject { create_encrypted_model :storage, passphrase: 'tool', encryptor: :search_encryptor }
-
-      it "searches if supported" do
-        expect { subject.search_by_plaintext(:storage, 'test1') }.to_not raise_error
-      end
-
-      it "complains about bad columns" do
-        expect { subject.search_by_plaintext(:what, 'test1') }.to raise_error(/what is not a crypt_keeper field/)
-      end
-    end
-
-    context "Encodings" do
-      subject { create_encrypted_model :storage, key: 'tool', salt: 'salt', encryptor: :aes_new, encoding: 'utf-8' }
-
-      it "forces the encoding on decrypt" do
-        record = subject.create!(storage: 'Tromsø')
-        record.reload
-        expect(record.storage).to eql('Tromsø')
-      end
-
-      it "converts from other encodings" do
-        plaintext = "\xC2\xA92011 AACR".force_encoding('ASCII-8BIT')
-        record = subject.create!(storage: plaintext)
-        record.reload
-        expect(record.storage.encoding.name).to eql('UTF-8')
-      end
-    end
-
-    context "Initial Table Encryption" do
-      subject { create_encrypted_model :storage, key: 'tool', salt: 'salt', encryptor: :aes_new }
-
-      before do
-        subject.delete_all
-        c = create_model
-        5.times { |i|  c.create! storage: "testing#{i}" }
-      end
-
-      it "encrypts the table" do
-        expect { subject.first(5).map(&:storage) }.to raise_error(OpenSSL::Cipher::CipherError)
-        subject.encrypt_table!
-        expect { subject.first(5).map(&:storage) }.not_to raise_error
-      end
-    end
-
-    context "Table Decryption (Reverse of Initial Table Encryption)" do
-      subject { create_encrypted_model :storage, key: 'tool', salt: 'salt', encryptor: :aes_new }
-      let!(:storage_entries) { 5.times.map { |i| "testing#{i}" } }
-
-      before do
-        subject.delete_all
-        storage_entries.each { |entry| subject.create! storage: entry}
-      end
-
-      it "decrypts the table" do
-        subject.decrypt_table!
-        expect( create_model.first(5).map(&:storage) ).to eq( storage_entries )
-      end
-    end
-
-    context "Missing Attributes" do
-      subject { create_encrypted_model :storage, key: 'tool', salt: 'salt', encryptor: :aes_new, encoding: 'utf-8' }
-
-      it "doesn't attempt decryption of missing attributes" do
-        subject.create!(storage: 'blah')
-        expect { subject.select(:id).first }.to_not raise_error
-      end
-    end
-  end
-end