sidekiq-crypt 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 27c186534a5ae125f231c97ecb3de4da4937a3a0e5a00dd4483e3d465f6ca597
-  data.tar.gz: 2882b0a69fd17bbc49cf69807cdc0fe3eaf9f537fe99d5f79c70f32ef9d58c3c
+  metadata.gz: 2cf6eb93e1cb1c3a08d28e06e5bf7bcbe302af373377f0aca7ff316043a71a8d
+  data.tar.gz: d8d4a6c6f1aaee676069a00bff9a42e3784b7aff00004ca3c540e077aa258454
 SHA512:
-  metadata.gz: 5cf5c266c766cd63279c3347daa0669fdfacf6e2cd48894d1280c41938dcd007ab64e96055cae60b002ad39b39a6955b682abe9bb555eb338deca7ddf0630901
-  data.tar.gz: caa5b5233652856aca55e17332518dfc63d1ec1e2d323fd688bc4fca5bad309b106a2da16531705d3121d76429160b1907e69e8aee3bbd8f8850c53ed2169e28
+  metadata.gz: 93851ab0b7b7351a6532cdee053a5b2952acc4d67fe91db721f9558e458d20154eeac7512b12fdb73a74420d51250031017a60a87e22bc23c08dcdb4b299e76d
+  data.tar.gz: d5125e23edf014d8f2a80cd535bb7477d46fcbe2fcfafd288c4355c384662bafae1aa01342f94e2273eb9e7a630b9dcdc501403ec0cf2ebe33f65b1fd1ed49ed

data/lib/sidekiq-crypt.rb

@@ -1,41 +1,73 @@
-require "sidekiq-crypt/version"
-require 'sidekiq-crypt/configuration'
-require 'sidekiq-crypt/client_middleware'
-require 'sidekiq-crypt/server_middleware'
+# frozen_string_literal: true
+
+require_relative 'sidekiq-crypt/version'
+require_relative 'sidekiq-crypt/configuration'
+require_relative 'sidekiq-crypt/cipher'
+require_relative 'sidekiq-crypt/client_middleware'
+require_relative 'sidekiq-crypt/server_middleware'
+require_relative 'sidekiq-crypt/worker'
 
 module Sidekiq
   module Crypt
     class << self
-      def configuration
-        @configuration ||= Configuration.new
+      def configuration(options = {})
+        @configuration ||= Configuration.new(options)
       end
 
       def configure(options = {})
-        yield(configuration) if block_given?
+        block_given? ? yield(configuration(options)) : configuration(options)
 
         configuration.filters.flatten!
-        raise 'you must specify at least one filter' if configuration.filters.empty?
+        validate_configuration!
 
         inject_sidekiq_middlewares
       end
 
       def inject_sidekiq_middlewares
+        inject_client_middleware
+        inject_server_middleware
+      end
+
+      private
+
+      def inject_client_middleware
         ::Sidekiq.configure_client do |config|
           config.client_middleware do |chain|
             chain.add Sidekiq::Crypt::ClientMiddleware, configuration: configuration
           end
         end
+      end
 
+      def inject_server_middleware
         ::Sidekiq.configure_server do |config|
           config.client_middleware do |chain|
             chain.add Sidekiq::Crypt::ClientMiddleware, configuration: configuration
           end
 
           config.server_middleware do |chain|
-            chain.add Sidekiq::Crypt::ServerMiddleware, configuration: configuration
+            chain.add Sidekiq::Crypt::ServerMiddleware
           end
         end
       end
+
+      def validate_configuration!
+        raise 'you must specify current key version' if configuration.current_key_version.blank?
+        raise 'you must specify a hash for key store' if configuration.key_store.blank?
+        raise "current_key_version can't be found in key_store" if current_raw_key.nil?
+        raise 'current key is not valid for encryption' if invalid_key?
+      end
+
+      def current_raw_key
+        # returns the base64 encoded version of the key
+        configuration.key_store[configuration.current_key_version]
+      end
+
+      def invalid_key?
+        Sidekiq::Crypt::Cipher.encrypt('dummy_str', Sidekiq::Crypt::Cipher.random_iv)
+        false
+      rescue StandardError
+        true
+      end
     end
   end
 end

data/lib/sidekiq-crypt/cipher.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'openssl'
+require 'base64'
+
+module Sidekiq
+  module Crypt
+    module Cipher
+      class << self
+        def encrypt(confidential_param, initialization_vector)
+          encryptor = encryption_cipher(initialization_vector)
+          # use base64 to prevent Encoding::UndefinedConversionError
+          Base64.encode64(encryptor.update(confidential_param.to_s) + encryptor.final)
+        end
+
+        def decrypt(confidential_param, initialization_vector, key_version)
+          decryptor_cipher = decryption_cipher(initialization_vector, key_version)
+
+          decryptor_cipher.update(Base64.decode64(confidential_param.to_s)) + decryptor_cipher.final
+        end
+
+        def random_iv
+          OpenSSL::Cipher::AES.new(256, :CBC).encrypt.random_iv
+        end
+
+        private
+
+        def encryption_cipher(initialization_vector)
+          cipher = OpenSSL::Cipher::AES.new(256, :CBC).encrypt
+          cipher.key = Sidekiq::Crypt.configuration.current_key
+          cipher.iv = initialization_vector
+
+          cipher
+        end
+
+        def decryption_cipher(initialization_vector, key_version)
+          cipher = OpenSSL::Cipher::AES.new(256, :CBC).decrypt
+          cipher.key = Sidekiq::Crypt.configuration.key_by_version(key_version)
+          cipher.iv = initialization_vector
+
+          cipher
+        end
+      end
+    end
+  end
+end

data/lib/sidekiq-crypt/client_middleware.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require 'sidekiq-crypt/traverser'
+require 'set'
+
+module Sidekiq
+  module Crypt
+    class ClientMiddleware
+      def initialize(opts = {})
+        @configuration = opts[:configuration]
+        @encrypted_keys = Set.new
+      end
+
+      def call(worker_class, job, _queue, _redis_pool)
+        if encrypted_worker?(worker_class, job)
+          @iv = Cipher.random_iv
+          traverser.traverse!(job['args'], encryption_proc)
+          write_encryption_header_to_redis(job['jid'], encrypted_keys)
+        end
+
+        yield
+      end
+
+      private
+
+      attr_reader :configuration, :encrypted_keys
+
+      def encrypted_worker?(worker_class, job)
+        @worker_klass = worker_class(worker_class, job)
+        @worker_klass && @worker_klass.ancestors.include?(Sidekiq::Crypt::Worker)
+      end
+
+      def traverser
+        Traverser.new(@worker_klass.sidekiq_crypt_worker_filters || configuration.filters)
+      end
+
+      def write_encryption_header_to_redis(job_id, encrypted_keys)
+        Sidekiq.redis do |conn|
+          conn.set(
+            "sidekiq-crpyt-header:#{job_id}",
+            JSON.generate(
+              nonce: Base64.encode64(@iv),
+              encrypted_keys: encrypted_keys.to_a,
+              key_version: Sidekiq::Crypt.configuration.current_key_version
+            )
+          )
+        end
+      end
+
+      def encryption_proc
+        proc do |key, param|
+          encrypted_keys << key
+          Cipher.encrypt(param, @iv)
+        end
+      end
+
+      def worker_class(worker_class, job)
+        klass = begin
+                  job['args'][0]['job_class'] || worker_class
+                rescue StandardError
+                  worker_class
+                end
+
+        if klass.is_a?(Class)
+          klass
+        elsif Module.const_defined?(klass)
+          Module.const_get(klass)
+        end
+      end
+    end
+  end
+end

data/lib/sidekiq-crypt/configuration.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Sidekiq
+  module Crypt
+    class Configuration
+      attr_accessor :filters, :current_key_version
+      attr_reader :key_store
+
+      def initialize(options = {})
+        @filters = []
+        @current_key_version = options.fetch(:current_key_version, nil)
+        @key_store = options.fetch(:key_store, {}).transform_keys(&:to_s)
+
+        include_rails_filter_parameters(options[:exclude_rails_filters])
+      end
+
+      def current_key
+        Base64.strict_decode64(key_store[current_key_version])
+      end
+
+      def key_by_version(given_key)
+        Base64.strict_decode64(key_store[given_key])
+      end
+
+      def key_store=(key_store_hash)
+        @key_store = (key_store_hash || {}).transform_keys(&:to_s)
+      end
+
+      private
+
+      def include_rails_filter_parameters(exclude_rails_filters)
+        return unless defined?(::Rails)
+        return if exclude_rails_filters
+
+        @filters = ::Rails.application.config.filter_parameters
+      end
+    end
+  end
+end

data/lib/sidekiq-crypt/server_middleware.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+module Sidekiq
+  module Crypt
+    class ServerMiddleware
+      FILTERED = '[FILTERED]'
+
+      def call(_worker_class, job, _queue, _redis_pool = {})
+        return yield unless encrypted_worker?(job)
+
+        encrypt_secret_params(job)
+
+        yield
+
+        delete_encryption_header(job['jid'])
+      rescue StandardError => e
+        if encrypted_worker?(job)
+          Traverser.new(@encryption_header[:encrypted_keys]).traverse!(job['args'], filter_proc)
+        end
+
+        raise e
+      end
+
+      private
+
+      def encrypt_secret_params(job)
+        @encryption_header = read_encryption_header_from_redis(job['jid'])
+        Traverser.new(@encryption_header[:encrypted_keys]).traverse!(job['args'], decryption_proc)
+      end
+
+      def encrypted_worker?(job)
+        klass = worker_klass(job)
+        klass && klass.ancestors.include?(Sidekiq::Crypt::Worker)
+      end
+
+      def worker_klass(job)
+        klass = begin
+                  job['args'][0]['job_class'] || job['class']
+                rescue StandardError
+                  job['class']
+                end
+        klass.is_a?(Class) ? klass : Module.const_get(klass)
+      end
+
+      def decryption_proc
+        proc do |_key, param|
+          Cipher.decrypt(param, @encryption_header[:iv], @encryption_header[:key_version])
+        end
+      end
+
+      def filter_proc
+        proc { |_key, _param| FILTERED }
+      end
+
+      def read_encryption_header_from_redis(job_id)
+        parsed_header = JSON.parse(read_encryption_header(job_id))
+
+        {
+          iv: Base64.decode64(parsed_header['nonce']),
+          encrypted_keys: parsed_header['encrypted_keys'],
+          key_version: parsed_header['key_version']
+        }
+      end
+
+      def read_encryption_header(job_id)
+        Sidekiq.redis do |conn|
+          conn.get("sidekiq-crpyt-header:#{job_id}")
+        end
+      end
+
+      def delete_encryption_header(job_id)
+        Sidekiq.redis do |conn|
+          conn.del("sidekiq-crpyt-header:#{job_id}")
+        end
+      end
+    end
+  end
+end

data/lib/sidekiq-crypt/traverser.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require 'uri'
+
+module Sidekiq
+  module Crypt
+    class Traverser
+      def initialize(filters)
+        @filters = filters
+      end
+
+      def traverse!(args, proc)
+        args.each_with_index do |arg, index|
+          next unless arg.is_a?(Hash) || arg.is_a?(Array)
+
+          # override the params
+          args[index] = traverse(arg, proc)
+        end
+      end
+
+      private
+
+      def traverse(object, proc)
+        # sidekiq arguments must be serialized as JSON.
+        # Therefore, object could be hash, array or primitives like string/number
+        # Also, recursive hashes or arrays is not possible.
+        case object
+        when Hash
+          clean_hash = {}
+
+          object.each do |key, value|
+            clean_hash[key] = filter_match?(key) ? proc.call(key, value) : traverse(value, proc)
+          end
+
+          clean_hash
+        when Array then object.map { |element| traverse(element, proc) }
+        else object
+        end
+      end
+
+      def filter_match?(key)
+        @filters.any? do |filter|
+          case filter
+          when Regexp then key.to_s.match(filter)
+          else key.to_s == filter.to_s
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sidekiq-crypt/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Sidekiq
+  module Crypt
+    VERSION = '0.1.1'
+  end
+end

data/lib/sidekiq-crypt/worker.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Sidekiq
+  module Crypt
+    module Worker
+      def self.included(base)
+        base.extend(ClassMethods)
+      end
+
+      module ClassMethods
+        attr_reader :sidekiq_crypt_worker_filters
+
+        def encrypted_keys(*filter_keys)
+          @sidekiq_crypt_worker_filters = filter_keys
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,29 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: sidekiq-crypt
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Murat Toygar
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-10-06 00:00:00.000000000 Z
+date: 2020-04-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sidekiq
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '5.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '5.0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -39,35 +39,35 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.17'
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '5.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '5.0'
 - !ruby/object:Gem::Dependency
-  name: minitest
+  name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
-  name: appraisal
+  name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -88,6 +88,13 @@ extensions: []
 extra_rdoc_files: []
 files:
 - lib/sidekiq-crypt.rb
+- lib/sidekiq-crypt/cipher.rb
+- lib/sidekiq-crypt/client_middleware.rb
+- lib/sidekiq-crypt/configuration.rb
+- lib/sidekiq-crypt/server_middleware.rb
+- lib/sidekiq-crypt/traverser.rb
+- lib/sidekiq-crypt/version.rb
+- lib/sidekiq-crypt/worker.rb
 homepage: https://rubygems.org/gems/sidekiq-crypt
 licenses:
 - MIT
@@ -107,7 +114,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.4
+rubygems_version: 3.0.6
 signing_key: 
 specification_version: 4
 summary: encrypts confidential sidekiq parameters on redis