crypt_keeper 2.0.0.rc2 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2d2c48e454fad3b2d938bbcabb028983954c991479524a7240acb772b46e37b1
-  data.tar.gz: 907dd02f441238eaa0a3a77c8be9dd5f936a615630bc96c6759930f74da99f06
+  metadata.gz: a090653644f2d7aba77cd684309d1a720f3a956a8568d5c03f06985ca8b608ff
+  data.tar.gz: a61221ebb211944e2f2695f223da199c905e6ae70ce681aa3d4c909e61801e6c
 SHA512:
-  metadata.gz: d9a292f9d37a60cf43a9f27c4981e6bfbfd7f603e5f53cbc08932103d9fd61c3c83c141ba56d67b26b7925a7f6d46b87885a9d595ce0b7eaa37ca7e846ee24ca
-  data.tar.gz: 61def2dfc5d5deadb6b9f667d2b8490cc357e4956059abf45fedc7adae856a95d5f90fe2364da402dbcd0d00b791205e1a9222ce53c190b42b6fa92d0c65bb91
+  metadata.gz: 2eb493363aad423a7ea2131056b48e0c5be36ee4c61f46e1bc3dda20dba6cd70ac72e2f2a1741ed004a5e35c6b2526faaeaab5b777fee9f768a9ddd5e4a97db2
+  data.tar.gz: dd4f889755d15483c9777199a3e332d0d66b8845355179d9fbd4b0dc26e8524ad54cbe4df6a88882d7669d0f27c9bb37fc2473379ed2ada777a897ff41f5ca57

data/.travis.yml

@@ -1,20 +1,60 @@
 language: ruby
 
 rvm:
-  - 2.2.7
-  - 2.3.4
-  - 2.4.1
+  - 2.2.10
+  - 2.3.8
+  - 2.4.5
+  - 2.5.3
+  - 2.6.4
+  - 2.7.2
 
 gemfile:
   - gemfiles/activerecord_4_2.gemfile
   - gemfiles/activerecord_5_0.gemfile
   - gemfiles/activerecord_5_1.gemfile
   - gemfiles/activerecord_5_2.gemfile
+  - gemfiles/activerecord_6_0.gemfile
+  - gemfiles/activerecord_6_1.gemfile
+  
 
-addons:
-  postgresql: 9.3
+matrix:
+  exclude:
+  - rvm: 2.2.10
+    gemfile: gemfiles/activerecord_5_0.gemfile
+  - rvm: 2.2.10
+    gemfile: gemfiles/activerecord_5_1.gemfile
+  - rvm: 2.2.10
+    gemfile: gemfiles/activerecord_6_0.gemfile
+  - rvm: 2.2.10
+    gemfile: gemfiles/activerecord_6_1.gemfile
+  - rvm: 2.3.8
+    gemfile: gemfiles/activerecord_5_0.gemfile
+  - rvm: 2.3.8
+    gemfile: gemfiles/activerecord_5_1.gemfile
+  - rvm: 2.3.8
+    gemfile: gemfiles/activerecord_6_0.gemfile
+  - rvm: 2.3.8
+    gemfile: gemfiles/activerecord_6_1.gemfile
+  - rvm: 2.4.5
+    gemfile: gemfiles/activerecord_5_0.gemfile
+  - rvm: 2.4.5
+    gemfile: gemfiles/activerecord_5_1.gemfile
+  - rvm: 2.4.5
+    gemfile: gemfiles/activerecord_6_0.gemfile
+  - rvm: 2.4.5
+    gemfile: gemfiles/activerecord_6_1.gemfile
+  - rvm: 2.5.3
+    gemfile: gemfiles/activerecord_5_0.gemfile
+  - rvm: 2.5.3
+    gemfile: gemfiles/activerecord_5_1.gemfile
+  - rvm: 2.6.4
+    gemfile: gemfiles/activerecord_5_0.gemfile
+  - rvm: 2.6.4
+    gemfile: gemfiles/activerecord_5_1.gemfile
 
-sudo: false
+services:
+  - postgresql
+  - mysql
 
 before_script:
   - cp spec/default.database.yml spec/database.yml
@@ -22,7 +62,8 @@ before_script:
   - psql crypt_keeper_providers -c 'CREATE EXTENSION IF NOT EXISTS pgcrypto;' -U postgres
   - mysql -e 'CREATE DATABASE crypt_keeper_providers'
 
-branches: master
+branches: 
+  - master
 
 notifications:
   email:

data/Appraisals

@@ -1,11 +1,17 @@
 appraise "activerecord_4_2" do
   gem "activerecord",  "~> 4.2.0"
   gem "activesupport", "~> 4.2.0"
+  gem "sqlite3", "~> 1.3.0"
+
+  # otherwise you get "undefined method `new' for BigDecimal:Class" in Ruby 2.7
+  gem "bigdecimal", "1.3.5"
 end
 
 appraise "activerecord_5_0" do
   gem "activerecord",  "~> 5.0.0"
   gem "activesupport", "~> 5.0.0"
+
+  gem "sqlite3", "~> 1.3.6"
 end
 
 appraise "activerecord_5_1" do
@@ -17,3 +23,20 @@ appraise "activerecord_5_2" do
   gem "activerecord",  "~> 5.2.0"
   gem "activesupport", "~> 5.2.0"
 end
+
+appraise "activerecord_6_0" do
+  gem "activerecord",  "~> 6.0.0"
+  gem "activesupport", "~> 6.0.0"
+end
+
+appraise "activerecord_6_1" do
+  gem "activerecord",  "~> 6.1.0"
+  gem "activesupport", "~> 6.1.0"
+  gem "pg", "~> 1.1"
+end
+
+appraise "activerecord_7_0" do
+  gem "activerecord",  "~> 7.0"
+  gem "activesupport", "~> 7.0"
+  gem "pg", "~> 1.1"
+end

data/README.md

@@ -151,10 +151,10 @@ Searching ciphertext is a complex problem that varies depending on the encryptio
   * ActiveSupport's MessageEncryptor uses a random initialization vector when generating keys. The same plaintext encrypted multiple times will have different output each time for the ciphertext. Since this is the case, it is not possible to search leveraging the database. Database rows will need to be filtered in memory. It is suggested that you use a scope or ActiveRecord batches to narrow the results before seaching them.
 
 * Mysql AES
- * Surprisingly, MySQL's implementation of AES does not use a random initialization vector. The column containing the ciphertext can be indexed and searched quickly.
+  * Surprisingly, MySQL's implementation of AES does not use a random initialization vector. The column containing the ciphertext can be indexed and searched quickly.
 
 * PostgresSQL PGP
- * PGP also uses a random initialization vector which means it generates unique output each time you encrypt plaintext. Although the database can be searched by performing row level decryption and comparing the plaintext, it will not be able to use an index. A scope or batch is suggested when searching.
+  * PGP also uses a random initialization vector which means it generates unique output each time you encrypt plaintext. Although the database can be searched by performing row level decryption and comparing the plaintext, it will not be able to use an index. A scope or batch is suggested when searching.
 
 ## How the search interface is used
 

data/crypt_keeper.gemspec

@@ -18,13 +18,13 @@ Gem::Specification.new do |gem|
 
   gem.post_install_message = "WARNING: CryptKeeper 2.0 contains breaking changes and may require you to reencrypt your data! Please view the README at https://github.com/jmazzi/crypt_keeper for more information."
 
-  gem.add_runtime_dependency 'activerecord',  '>= 4.2', '< 5.3'
-  gem.add_runtime_dependency 'activesupport', '>= 4.2', '< 5.3'
+  gem.add_runtime_dependency 'activerecord',  '>= 4.2', '<= 7'
+  gem.add_runtime_dependency 'activesupport', '>= 4.2', '<= 7'
 
   gem.add_development_dependency 'rspec',       '~> 3.5.0'
   gem.add_development_dependency 'guard',       '~> 2.6.1'
   gem.add_development_dependency 'guard-rspec', '~> 4.2.9'
-  gem.add_development_dependency 'rake',        '~> 10.3.1'
+  gem.add_development_dependency 'rake'
   gem.add_development_dependency 'rb-fsevent',  '~> 0.9.1'
   gem.add_development_dependency 'coveralls'
   gem.add_development_dependency 'appraisal',   '~> 2.1.0'
@@ -35,7 +35,7 @@ Gem::Specification.new do |gem|
     gem.add_development_dependency 'activerecord-jdbcpostgresql-adapter'
     gem.add_development_dependency 'activerecord-jdbcmysql-adapter'
   else
-    gem.add_development_dependency 'sqlite3'
+    gem.add_development_dependency 'sqlite3', '>= 1.3.3', '< 1.5'
     gem.add_development_dependency 'pg', '~> 0.18.0'
     gem.add_development_dependency 'mysql2', '>= 0.3.13', '< 0.6.0'
   end

data/gemfiles/activerecord_4_2.gemfile

@@ -4,6 +4,7 @@ source "https://rubygems.org"
 
 gem "activerecord", "~> 4.2.0"
 gem "activesupport", "~> 4.2.0"
-gem "mysql2", ">= 0.3.13", "< 0.5"
+gem "sqlite3", "~> 1.3.0"
+gem "bigdecimal", "1.3.5"
 
 gemspec :path => "../"

data/gemfiles/activerecord_5_0.gemfile

@@ -4,6 +4,6 @@ source "https://rubygems.org"
 
 gem "activerecord", "~> 5.0.0"
 gem "activesupport", "~> 5.0.0"
-gem "mysql2", ">= 0.3.18", "< 0.6.0"
+gem "sqlite3", "~> 1.3.6"
 
 gemspec :path => "../"

data/gemfiles/activerecord_5_1.gemfile

@@ -4,6 +4,5 @@ source "https://rubygems.org"
 
 gem "activerecord", "~> 5.1.0"
 gem "activesupport", "~> 5.1.0"
-gem "mysql2", ">= 0.3.18", "< 0.6.0"
 
 gemspec :path => "../"

data/gemfiles/activerecord_5_2.gemfile

@@ -4,6 +4,5 @@ source "https://rubygems.org"
 
 gem "activerecord", "~> 5.2.0"
 gem "activesupport", "~> 5.2.0"
-gem "mysql2", ">= 0.4.4", "< 0.6.0"
 
 gemspec :path => "../"

data/gemfiles/activerecord_6_0.gemfile

@@ -0,0 +1,8 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "activerecord", "~> 6.0.0"
+gem "activesupport", "~> 6.0.0"
+
+gemspec :path => "../"

data/gemfiles/activerecord_6_1.gemfile

@@ -0,0 +1,9 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "activerecord", "~> 6.1.0"
+gem "activesupport", "~> 6.1.0"
+gem "pg", "~> 1.1"
+
+gemspec :path => "../"

data/gemfiles/activerecord_7_0.gemfile

@@ -0,0 +1,9 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "activerecord", "~> 7.0"
+gem "activesupport", "~> 7.0"
+gem "pg", "~> 1.1"
+
+gemspec :path => "../"

data/lib/crypt_keeper/helper.rb

@@ -12,6 +12,10 @@ module CryptKeeper
       def escape_and_execute_sql(query, new_transaction: false)
         query = ::ActiveRecord::Base.send :sanitize_sql_array, query
 
+        # force binary encoding to avoid "invalid byte sequence in UTF-8" errors
+        # when we send binary AES keys (f.ex) to the database
+        query = query.b if query.respond_to?(:b)
+
         if CryptKeeper.silence_logs?
           ::ActiveRecord::Base.logger.silence do
             execute_sql(query, new_transaction: new_transaction)

data/lib/crypt_keeper/provider/postgres_pgp.rb

@@ -42,8 +42,14 @@ module CryptKeeper
       end
 
       def search(records, field, criteria)
-        records.where("(pgp_sym_decrypt(cast(\"#{field}\" AS bytea), ?) = ?)",
-          key, criteria)
+        if criteria.present?
+          records
+            .where.not("TRIM(BOTH FROM \"#{field}\") = ?", "")
+            .where("(pgp_sym_decrypt(cast(\"#{field}\" AS bytea), ?) = ?)",
+                   key, criteria)
+        else
+          records.where(field => criteria)
+        end
       end
 
       private

data/lib/crypt_keeper/version.rb

@@ -1,3 +1,3 @@
 module CryptKeeper
-  VERSION = "2.0.0.rc2"
+  VERSION = "2.3.0"
 end

data/spec/crypt_keeper/model_spec.rb

@@ -25,8 +25,7 @@ describe CryptKeeper::Model do
       end
 
       it "allows binary as a valid type" do
-        subject.crypt_keeper :storage, encryptor: :fake_encryptor
-        allow(subject.columns_hash['storage']).to receive(:type).and_return(:binary)
+        subject.crypt_keeper :storage_binary, encryptor: :fake_encryptor
         expect(subject.new.save).to be_truthy
       end
 
@@ -55,6 +54,7 @@ describe CryptKeeper::Model do
     end
   end
 
+  
   context "Encryption and Decryption" do
     let(:plain_text) { 'plain_text' }
     let(:cipher_text) { 'tooltxet_nialp' }
@@ -105,6 +105,21 @@ describe CryptKeeper::Model do
       expect_any_instance_of(CryptKeeper::Provider::Encryptor).to_not receive(:decrypt)
       subject.find(record.id).storage
     end
+
+    context "with a binary database field" do
+       subject { create_encrypted_model :storage_binary, passphrase: 'tool', encryptor: :encryptor }
+
+      it "encrypts the data" do
+        expect_any_instance_of(CryptKeeper::Provider::Encryptor).to receive(:encrypt).with('testing')
+        subject.create!(storage_binary: 'testing')
+      end
+
+      it "decrypts the data" do
+        record = subject.create!(storage_binary: 'testing')
+        expect_any_instance_of(CryptKeeper::Provider::Encryptor).to receive(:decrypt).at_least(1).times.with('toolgnitset')
+        subject.find(record.id).storage_binary
+      end
+    end
   end
 
   context "Search" do

data/spec/crypt_keeper/provider/postgres_pgp_spec.rb

@@ -64,6 +64,42 @@ describe CryptKeeper::Provider::PostgresPgp do
       match = subject.create!(storage: 'blah')
       expect(subject.search_by_plaintext(:storage, 'blah').first).to eq(match)
     end
+
+    it "successfully accesses result when the data has empty strings and nil" do
+      subject.create!(storage: nil)
+      subject.create!(storage: '')
+      subject.create!(storage: '   ')
+      match = subject.create!(storage: 'blah')
+
+      results = subject.search_by_plaintext(:storage, 'blah')
+
+      expect(results).to match_array([match])
+    end
+
+    it "finds an empty string" do
+      subject.create!(storage: nil)
+      subject.create!(storage: 'blah')
+      match = subject.create!(storage: '')
+
+      expect(subject.search_by_plaintext(:storage, '')).to match_array([match])
+    end
+
+    it "finds the empty string with the right number of spaces" do
+      subject.create!(storage: '')
+      match = subject.create!(storage: '   ')
+
+      results = subject.search_by_plaintext(:storage, '   ')
+
+      expect(results).to match_array([match])
+    end
+
+    it "finds nil results" do
+      subject.create!(storage: '')
+      subject.create!(storage: 'blah')
+      match = subject.create!(storage: nil)
+
+      expect(subject.search_by_plaintext(:storage, nil)).to match_array([match])
+    end
   end
 
   describe "Custom pgcrypto options" do

data/spec/spec_helper.rb

@@ -14,7 +14,11 @@ RSpec.configure do |config|
   config.filter_run :focus
 
   config.after :each do
-    ActiveRecord::Base.descendants.each do |model|
+    descendants = ActiveRecord::Base.descendants.delete_if do |descendant|
+      descendant.to_s.include?("SchemaMigration")
+    end
+
+    descendants.each do |model|
       model.method(:delete_all).call
     end
   end

data/spec/support/active_record.rb

@@ -18,6 +18,7 @@ module CryptKeeper
           create_table :sensitive_data, :force => true do |t|
             t.column :name, :string
             t.column :storage, :text
+            t.column :storage_binary, :binary
             t.column :secret, :text
           end
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: crypt_keeper
 version: !ruby/object:Gem::Version
-  version: 2.0.0.rc2
+  version: 2.3.0
 platform: ruby
 authors:
 - Justin Mazzi
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-04-10 00:00:00.000000000 Z
+date: 2021-12-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -17,9 +17,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '4.2'
-    - - "<"
+    - - "<="
       - !ruby/object:Gem::Version
-        version: '5.3'
+        version: '7'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -27,9 +27,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '4.2'
-    - - "<"
+    - - "<="
       - !ruby/object:Gem::Version
-        version: '5.3'
+        version: '7'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
@@ -37,9 +37,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '4.2'
-    - - "<"
+    - - "<="
       - !ruby/object:Gem::Version
-        version: '5.3'
+        version: '7'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -47,9 +47,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '4.2'
-    - - "<"
+    - - "<="
       - !ruby/object:Gem::Version
-        version: '5.3'
+        version: '7'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -96,16 +96,16 @@ dependencies:
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 10.3.1
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 10.3.1
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rb-fsevent
   requirement: !ruby/object:Gem::Requirement
@@ -154,14 +154,20 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 1.3.3
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.5'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 1.3.3
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.5'
 - !ruby/object:Gem::Dependency
   name: pg
   requirement: !ruby/object:Gem::Requirement
@@ -217,6 +223,9 @@ files:
 - gemfiles/activerecord_5_0.gemfile
 - gemfiles/activerecord_5_1.gemfile
 - gemfiles/activerecord_5_2.gemfile
+- gemfiles/activerecord_6_0.gemfile
+- gemfiles/activerecord_6_1.gemfile
+- gemfiles/activerecord_7_0.gemfile
 - lib/crypt_keeper.rb
 - lib/crypt_keeper/helper.rb
 - lib/crypt_keeper/log_subscriber/mysql_aes.rb
@@ -261,13 +270,12 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
-signing_key: 
+rubygems_version: 3.1.4
+signing_key:
 specification_version: 4
 summary: Transparent ActiveRecord encryption
 test_files: